About the program
SUDAPASS is the national digital-identity gateway. We welcome coordinated vulnerability disclosure across the platform and its public surfaces.
In scope
3 assetsDomain
*.sudapass.online
All subdomains
Domain
sudapass.online
Primary domain
MobileApp
sd.sudapass.app (Android & iOS)
Mobile applications
In scope
sudapass.online*.sudapass.online- The SUDAPASS mobile app (Android + iOS)
Out of scope
Out of scope
- Marketing site
- Third-party content providers
- Findings without a proof of concept
- Email spoofing, SPF/DKIM/DMARC misconfigurations alone
Rules of engagement
Rules of engagement
- Use throwaway accounts for testing.
- No DoS, volumetric testing, or social engineering of staff.
- Limit data access to what is strictly required to demonstrate impact.
- Disclose only through this platform.
Safe harbor
Safe harbor
Good-faith research on the in-scope assets is authorised. We will not pursue legal action against researchers who follow this policy.
Disclosure policy
Disclosure
Reports are private by default. We target a 90-day window between fix and public advisory, extendable on good-faith remediation.