Responsible Disclosure

People trust us with their names, addresses and phone numbers when they order. Keeping that safe is part of the job.

No website is free of flaws. If you have found a security vulnerability on myskinmatters.in, we want to hear about it from you before anyone else finds it. This page explains how to report it, what you may and may not test, and what we promise in return.

Report to: contact@myskinmatters.in

Last updated: 18 October 2026

What Is in Scope

This policy covers websites and services that KIEVORA Private Limited owns and operates under the SKIN MATTERS brand.

Systems in scope

Myskinmatters.in and www.myskinmatters.in
Customer account, cart and checkout pages on those domains, up to the point where you are handed over to the payment provider
Forms on those domains, including contact, grievance, privacy request and review forms
Emails and SMS sent by us, where the flaw lets someone forge or tamper with them

Findings we most want to hear about

Access to another customer’s personal data, order history or account
Logging in as, or taking over, someone else’s account
Changing the price, discount or payment status of an order without paying

Injection flaws, such as SQL injection or stored cross-site scripting, that affect other users
Running code on our servers
Bypassing login, password reset or one-time-password checks
Exposure of keys, passwords or internal files
Takeover of a subdomain we own
Flaws that let someone send messages that appear to come from SKIN MATTERS

If you are unsure whether something is in scope, ask us at contact@myskinmatters.in before you test.

What Is Out of Scope

Systems out of scope

These are run by other companies. We have no authority to let you test them, and this policy gives you no protection if you do.

The payment pages and systems of Cashfree Payments
The tracking pages and systems of our courier partners
The underlying e-commerce platform, WordPress and WooCommerce, and its shared infrastructure
Third-party tools embedded in the site, such as chat, reviews, analytics and email delivery services
Marketplaces and other retailers that list SKIN MATTERS products
Social media accounts and platforms
Our offices, staff devices and the manufacturer’s facility

If you find a flaw in one of these, please report it to that company through its own disclosure programme. If the flaw exposes SKIN MATTERS customer data, tell us too, without testing further.

Reports we cannot act on

These are either low risk, already known, or need conditions that do not reflect a real attack. We will thank you for writing, but we do not treat them as vulnerabilities under this policy.

Output from an automated scanner with no working proof that the issue can be exploited
Missing security headers or cookie flags, with no demonstrated impact
Clickjacking on pages that carry out no sensitive action
Self cross-site scripting, where only the person typing can be affected
Logout cross-site request forgery, and request forgery on forms that change nothing sensitive
Open redirects with no further impact
Email records such as SPF, DKIM or DMARC settings, without a working spoofing demonstration
Software version or banner disclosure
Rate limiting or brute-force reports on forms that hold no sensitive data
Finding out whether an email address or phone number is registered
Password strength rules and session length
Weak SSL or TLS settings with no practical attack
Attacks that need physical access to a person’s unlocked device, a rooted or jailbroken phone, or a network the attacker already controls
Problems only present in outdated or unsupported browsers
Formula injection in exported spreadsheets
Denial-of-service of any kind
Social engineering, phishing or physical intrusion
Use of coupon codes or offers in ways the offer terms did not intend, where no security control is bypassed. Please send those to contact@myskinmatters.in instead.

How to Report a Vulnerability

Email contact@myskinmatters.in with the subject line “Vulnerability report — short description”.
Write in English. One vulnerability per email keeps things clear.
Do not send security reports through chat, WhatsApp, social media or the general support mailbox. They may not reach the right person, and they are less private.

What to include

What it is. The type of vulnerability, in one line.
Where it is. The full URL, the parameter or field affected, and the date and time you found it.
How to reproduce it. Numbered steps that someone else can follow from a fresh browser.
Proof. Screenshots, a short screen recording, or the request and response. Mask any personal data that is not yours.
Impact. What an attacker could do with it, and to whom.
Your setup. Browser and version, device, and the IP address you tested from, so we can find your requests in our logs.
Test accounts. The email address of any account you created for testing.
How to credit you. The name or handle you would like us to use, or a note that you prefer to stay anonymous.
Suggested fix. Optional, and welcome.

Report form

You can report anonymously. If you do, we cannot send you updates or credit you.

Rules of Engagement

The protection in the next section applies to you as long as you follow these rules.

Please do

Test only against accounts and orders that are your own, or that you created for testing.
Stop as soon as you have enough to prove the vulnerability exists. Do not go further than a proof of concept needs.
Stop at once and tell us if you come across personal data, payment information or anything else that is not yours. Do not open, copy, save or share it.
Report to us promptly after you find the issue.
Give us a reasonable time to fix the issue before you tell anyone else. We ask you to wait until we tell you it is fixed. If that is taking long, we will tell you why.
Delete any data you collected during testing once we confirm the report is closed.
Follow the law that applies to you and to us.

Please do not

Do not access, change or delete data belonging to other customers or to us.
Do not place real orders you do not intend to pay for or receive, and do not interfere with other people’s orders, deliveries or refunds.
Do not run denial-of-service tests, load tests, or anything that slows the site for other users.
Do not run high-volume automated scanners or brute-force tools against the site.
Do not use social engineering, phishing or pretexting against our staff, customers, manufacturer or partners.
Do not attempt physical entry to any premises.
Do not upload malware, leave a backdoor, or move from one system to another once you have access.
Do not send spam or bulk messages through our forms.
Do not test third-party systems listed as out of scope.
Do not ask for payment as a condition of sharing the details of a vulnerability. We treat that as a threat, not a report.
Do not disclose the vulnerability publicly, or to anyone else, before the period in point 5 above has passed.

Our Promise to You

We consider security research carried out in line with this policy to be authorised by us.
If you act in good faith and follow this policy, KIEVORA Private Limited will not start civil proceedings against you, and will not file a criminal complaint against you, for that research. This includes complaints under sections 43 and 66 of the Information Technology Act 2000 for accessing our systems.
We will not treat research done under this policy as a breach of our Terms and Conditions. Where the Terms and Conditions conflict with this policy, this policy applies to that research.
If a third party takes action against you for research that followed this policy, we will make it known that your work was authorised by us.
This promise has limits, and you should know them.

It covers only the systems listed as in scope. We cannot authorise testing of systems owned by other companies, and we cannot speak for them.
It does not bind the police, a court, a regulator or any government body. We cannot stop them from acting on their own.
It does not apply if you break the rules of engagement, act in bad faith, harm our customers, or try to extort us.
It does not apply to anything that is not security research, such as fraud or the misuse of data.

If at any point you are unsure whether what you plan to do is covered, write to contact@myskinmatters.in first. Asking does not put you at risk.
We may be required by law to report certain security incidents to the Indian Computer Emergency Response Team (CERT-In) or to notify affected customers. If we do, we will not name you without your consent, unless the law requires it.

What Happens After You Report

Step	What we do	When
1. Acknowledge	We confirm we have your report and give you a reference.	Within 3 working days
2. Assess	We try to reproduce the issue and tell you whether we accept it as a vulnerability, and how severe we think it is.	As soon as we can reproduce it
3. Fix	We fix it, or reduce the risk while a full fix is built.	Depends on severity
4. Update	We keep you informed while the work is open.	Until the report is closed
5. Close	We tell you when it is fixed, and invite you to check. We agree with you if and when you may publish.	When the fix is live

How we rate severity

We rate each report by what an attacker could actually do and how many people it would affect.

Severity	Typical example	Priority
Critical	Access to customer data at scale, or code running on our servers	Worked on immediately
High	Takeover of an individual account, or bypass of login or OTP	Fixed ahead of other work
Medium	A flaw that needs unusual conditions or user action to exploit	Scheduled into the next release
Low	Limited impact, with no personal data exposed	Fixed when the affected area is next worked on

What you can expect from us

A reply from a person, not only an automated message.
An honest answer if we decide not to fix something, with the reason.
No request that you sign anything before we read your report.
If two people report the same issue, credit goes to the first complete report we received.
If we cannot reproduce the issue, we will ask you for more detail before closing it.

Recognition

We are a new brand with one product, and we do not run a paid bug bounty. We do not offer money, vouchers or products in exchange for vulnerability reports.

What we do offer, for a valid report that follows this policy:

A written thank you from us, which you may refer to.
Credit in any public note we publish about the fix, if you agree.

To be named, the report must be the first we received for that issue, it must be in scope, and you must have followed the rules of engagement. You need to be an adult, or have a parent or guardian’s consent, to be named.

If this changes and we begin offering rewards, this page will say so. Until it does, please do not expect one.

Reporting Something Else

The security mailbox is only for vulnerabilities in our systems. For anything else, these pages are faster.

A problem with your order, payment or refund: Contact support
A call, message or website pretending to be SKIN MATTERS and asking for an OTP, payment or personal details: write to contact@myskinmatters.in with a screenshot. We never ask for OTPs, card details or UPI PINs.
A product you think is fake: Report a Fake Product
A request to see, correct or delete your personal data: Privacy Requests and Consent
A site bug that is annoying but not a security risk, such as a broken link or a layout problem: Bugs and Suggestions
A complaint that support has not resolved: Grievance Redressal

If you are a customer and you think your own account has been accessed by someone else, change your password, then write to contact@myskinmatters.in straight away.

Legal Notes

This policy is published by KIEVORA Private Limited, First Floor, G-79, Ashok Vihar Phase-1 Road, New Delhi 110052, India, which operates myskinmatters.in.
By sending us a report, you confirm that it is your own work, that you followed this policy, and that we may use the information in it to fix and improve our systems. You keep any rights you have in your own write-up.
Nothing in this policy creates an employment, agency or contractor relationship between you and us.
We handle the personal details in your report as set out in the Privacy Policy. We use them only to respond to the report and to credit you if you have asked us to.
We may change or withdraw this policy at any time. A change does not remove the protection in “Our promise to you” for research you carried out, in line with the policy, before the change.
This policy is governed by the laws of India. The courts at New Delhi have jurisdiction.
Questions about this policy: contact@myskinmatters.in.