Last updated 16 October 2026
How to report
Email security@indoemail.in with what you found, the steps to reproduce it, the address or app affected, and what an attacker could do with it. Screenshots or a short video help. Write in English, Hindi or Bengali.
Please do not post the problem publicly, or tell others, until we have fixed it or 90 days have passed, whichever comes first. If we need longer, we will explain why.
How quickly we reply
| Step | When |
|---|---|
| We confirm we received your report | Within 2 working days |
| We tell you whether we can reproduce it and how serious we think it is | Within 7 working days |
| Critical problems fixed | As fast as possible, usually within 7 days |
| Other problems fixed | Within 90 days |
| We tell you it is fixed | When the fix is live |
In scope
- indoemail.in and its subdomains, including the web apps under /app
- The Indo Mail Android apps downloaded from indoemail.in
- Indo Mail mail servers: receiving mail, IMAP (port 993) and SMTP for mail apps (ports 465 and 587)
- The Indo Mail developer API
Not in scope
- Reports from automated scanners with no proof that the issue can be used
- Missing security headers that do not lead to a real attack
- Spam or phishing you received (forward these to abuse@indoemail.in)
- Problems that need a stolen or unlocked device
- Services run by other companies that we use
- Other apps of INDO CHATS PRIVATE LIMITED that run on their own websites, which have their own reporting addresses
Please do not
- Open, change or delete anyone else’s data. Use only accounts you created yourself.
- Run denial-of-service tests, or anything that slows the service for others.
- Send spam or phishing, or test social engineering on our staff or users.
- Keep testing after you have shown the problem exists.
Safe harbour
If you follow this page in good faith, we will not take legal action against you or ask anyone else to, for that research. If someone else takes action against you over research that followed these rules, we will say publicly that your work was authorised.
This does not cover anything outside these rules, or anything unlawful under Indian law.
Thanks
We do not have a paid bug bounty yet. With your permission, we thank researchers by name in our release notes once the fix is live.