Zesday — Security & Responsible Disclosure Policy

Version: 2.0 · Effective date: 16 September 2026

Qubrix Technode Private Limited welcomes good-faith reports that help protect Zesday customers, restaurants, delivery partners and systems.

1. Reporting

Email support@zesday.com with the subject Security vulnerability report. Include the affected URL, app and version; a clear description; steps to reproduce; the impact; supporting screenshots or logs with personal data removed; and a safe way to contact you. Do not attach live credentials, full payment data, identity documents or data taken from other users.

We will acknowledge a sufficiently detailed report, assess it by risk and give updates when we reasonably can. How quickly we fix an issue depends on its severity, how easily it can be reproduced, the providers involved and safe deployment. This policy does not promise a bounty or other payment.

2. Good-faith research rules

Use only accounts and data you own or have explicit permission to test. Stop as soon as you encounter another person's data. Use the minimum interaction needed to demonstrate the issue, and give us reasonable time to fix it before any public disclosure.

Do not carry out denial-of-service or resource-exhaustion attacks; social engineering; phishing; physical intrusion; malware distribution; credential stuffing; destructive testing; automated high-volume scanning; payment, refund or promo abuse; access to customer, restaurant or delivery-partner accounts without permission; or modification, deletion, download or retention of other people's data.

3. Out of scope without demonstrated impact

Examples include scanner-only reports, missing headers with no exploit, clickjacking on pages with no sensitive action, self-XSS, rate-limit observations with no security consequence, outdated component versions without a reachable vulnerability, and issues that need a rooted device or an already-compromised account. We may still review them, at lower priority.

4. Our commitments

For research carried out in line with this policy and the law, Zesday will treat the report as good-faith security research and will not pursue a claim against you for the authorised testing. This does not permit you to breach third-party systems or the law, and cannot bind regulators or other parties.

5. Keeping your account safe

Never share your sign-in code, delivery code, passwords, payment credentials or identity documents with an unsolicited caller or message. Zesday will never ask for your card PIN, CVV, UPI PIN or a one-time code. Restaurants and delivery partners: a change to your payout bank account always needs a one-time code sent to your registered mobile, and we notify you when it happens — tell us at once if you did not make the change. Report suspected account compromise or fraud immediately through in-app Help or support@zesday.com.