TiffinService Bug Bounty Program

Program Rules

• This program is intended for security professionals; only valid security findings qualify.
• Avoid actions that could compromise user data, privacy, or the stability of the platform.
• Please allow us time to resolve issues before publicly disclosing them.

Scope

Our focus is on the www.tiffinservice.app domain and associated mobile applications. Any third-party software or services are out of scope.

Out of Scope Vulnerabilities

• Denial of Service (DoS) attacks
• Social engineering or phishing
• Non-technical vulnerabilities (e.g., account enumeration, UI bugs)

How to Report

If you have found a security vulnerability, please contact us at [email protected] with a detailed description of the vulnerability, steps to reproduce it, and any supporting evidence.