Last updated 5 October 2026
The short version
- If you find a weakness in this website, write to support@thecomposta.com. We reply within 3 working days.
- Report it to us first, give us a reasonable time to fix it, and do not access or keep other people's data. We will not take legal action against good-faith research that follows these rules, within the limits set out in clause 3.
- We will never ask you to pay into a different bank account by email alone. Check payment details by phone.
This summary is a guide. The numbered clauses below are the policy.
1.Reporting a weakness
1.1If you believe you have found a security weakness in https://thecomposta.com, email support@thecomposta.com with the subject "Security". Tell us what you found, where, and how to reproduce it, and include any screenshots or steps. You can write in English or Hindi. A machine-readable contact is published at https://thecomposta.com/.well-known/security.txt.
1.2We acknowledge a report within 3 working days, tell you what we decide, and fix confirmed problems as quickly as we reasonably can.
1.3This notice covers this website and the systems we run to operate it. It does not cover the services we rely on, such as our website host or email provider. Please report weaknesses in those to the provider concerned.
2.What we ask of you
2.1Please:
- report the problem to us and give us a reasonable time to fix it before you tell anyone else;
- test only against your own information and accounts, and stop as soon as you have shown the problem;
- do not access, change, copy or keep other people's personal information, and if you come across any by accident, stop and tell us;
- do not run denial-of-service, spam, social-engineering or physical attacks, or test the systems of our providers.
3.What we promise, and its limits
3.1If you follow these rules and act in good faith, we will not take legal action against you for your research, and we will credit you, if you wish, once the problem is fixed. We do not run a paid bounty programme.
3.2This promise is limited. It cannot make lawful something that the law forbids, including accessing a computer system without permission or damaging or disrupting one under the Information Technology Act, 2000 (sections 43 and 66). It does not bind our service providers or any government authority or other person. It covers only our own website and systems.
3.3You may also report a weakness to the Indian Computer Emergency Response Team (CERT-In, cert-in.org.in), the national agency for cyber incidents, whether or not you have written to us.
4.Fraud using our name
4.1Criminals sometimes copy a business's name to trick buyers into paying the wrong account. We send our bank details only in a proforma invoice or a signed document, and we will never change them by email alone. Before you pay, confirm the details by phone with a number from our website, https://thecomposta.com. If you receive a message that claims to be from us and looks wrong, do not pay, and forward it to support@thecomposta.com.
4.2If you are in India and have already lost money, tell your bank at once and report the fraud to the National Cyber Crime Reporting Portal (cybercrime.gov.in) or by phone on 1930. Elsewhere, report it to your bank and to your national fraud or police reporting service.
5.Protecting your information
5.1Our Privacy policy explains how we protect personal information and what we do if a breach affects you.
6.Changes to this notice
6.1We may update this notice as our site or the law changes. We will post the new version here and change the “Last updated” date at the top of this page.