Security & Responsible Disclosure Policy

The following are in scope:

• The main web application at hotjobs.lk and its subdomains
• Any public API endpoints served under hotjobs.lk

The following are out of scope:

• Social engineering or phishing attempts against our staff or users
• Physical attacks against our offices or infrastructure
• Denial-of-service (DoS/DDoS) testing
• Spam, or automated scanning that degrades service for other users
• Findings on third-party services we don't control (e.g. payment processors, social login providers)
• Missing security headers or best-practice suggestions with no demonstrated impact
• Self-XSS or issues that require an unlikely amount of user interaction
• Reports generated purely by automated tools without manual verification

Email us at info@hotjobs.lk with the subject line "Security Report". Please include:

• A clear description of the vulnerability and its potential impact
• Step-by-step instructions to reproduce it
• The affected URL(s), endpoint(s), or feature(s)
• Any proof-of-concept code, screenshots, or request/response captures
• Your browser, OS, or tooling, if relevant

You're welcome to report in English, Sinhala, or Tamil - whichever is easiest for you.

Once you report an issue, here's what happens next:

• Acknowledgment of your report within 3 business days
• An initial assessment of severity and validity within 10 business days
• Regular updates as we work toward a fix, until it's resolved
• Credit on our acknowledgments page, if you'd like it

If you make a good-faith effort to follow this policy while researching and reporting a vulnerability, we will not pursue legal action against you for that research. In particular, we ask that you:

• Only interact with accounts you own, or with our explicit permission
• Avoid accessing, downloading, or modifying data belonging to other users beyond what's strictly necessary to demonstrate the issue
• Stop and report immediately if you encounter user data during testing, rather than continuing to explore
• Give us a reasonable amount of time to investigate and fix an issue before sharing it publicly
• Avoid degrading the experience of the site for other users (no DoS, no spam, no mass automated scanning)

We don't currently run a paid bug bounty program. What we do offer is genuine thanks: with your permission, we'll credit you by name (or handle) on our acknowledgments page for any valid, responsibly-disclosed report. If we introduce a paid program in the future, we'll announce it here.