Responsible Disclosure Policy

Effective date: 18 October 2026

Keeping our customers’ stores and their shoppers’ data safe matters to MoreBasket Private Limited (“morebasket”, “we”, “us”). We welcome reports from security researchers and others who find a vulnerability in our services. This policy explains how to report one, the rules for looking, and what you can expect from us.

1. How to report

Email admin@morebasket.com, with the subject “Security report”. Please include:

• a clear description of the vulnerability and where it is (the web address, the endpoint or the feature);
• the steps needed to reproduce it, and a short proof of concept if you can;
• what an attacker could do with it, in your view; and
• how to contact you, and whether you want to be credited.

Please do not include real personal data of other people in your report. If you must, keep it to the minimum needed to show the problem.

2. What is in scope

• https://www.morebasket.com and its subdomains that we run, and the store platform, back office, storefronts and APIs that we operate;
• the AI features, where the issue is a security or privacy flaw (for example, one Store’s data being exposed to another, or a way to make an AI agent act outside the permissions the owner gave it).

3. What is out of scope

• Services run by others, including Third-Party Services such as payment providers, shipping providers and sales channels, and Stores’ own custom code. Report problems in those to the owner.
• Denial-of-service and volume-based attacks, spam, and anything that degrades the service for others.
• Social engineering, phishing, or attacks on our staff, customers or Customers (shoppers).
• Physical attacks on our offices or providers’ facilities.
• Findings that need unlikely user interaction, outdated browsers or an already-compromised device; missing best-practice headers or settings with no security impact shown; and results from automated scanners with no proof of impact.

4. Rules for testing

If you test our services in good faith, you must:

1. only test against accounts and Stores that you own or have explicit permission to test, and never access, change, delete or keep other people’s data. If you reach someone else’s data by accident, stop, do not look further, and tell us;
2. stop as soon as you have enough evidence to show the problem. Do not go on to exploit it, pivot to other systems, or leave anything behind;
3. not degrade the service, send large volumes of traffic, or run tests that could affect other customers;
4. not disclose the problem to others, or publicly, until we have fixed it or agreed a date with you, which we will do within a reasonable time; and
5. not demand payment, or threaten to disclose or sell the problem, as a condition of telling us.

5. Safe harbour

If you follow this policy in good faith, we will not take legal action against you, or ask law enforcement to investigate you, for the testing that this policy allows, and we will tell others that you acted with our permission if they ask. This is a statement of our own position only. It does not bind third parties, such as other companies whose services we use, and it does not permit you to break any law or to harm anyone.

6. What you can expect from us

• We will acknowledge your report within three business days.
• We will investigate it, tell you whether we agree that it is a vulnerability, and keep you updated as we work on it.
• We will aim to fix confirmed vulnerabilities promptly, with the most serious ones first, and will tell you when it is fixed.
• We will credit you in our thanks, if you want, once it is fixed.
• We do not currently run a paid bug-bounty programme, and we cannot promise a monetary reward.

7. Changes

We may update this policy. The effective date above shows the latest version.