Skip to main content

Report a Security Issue

Last updated: August 14, 2026

This is ModernAstro's vulnerability disclosure policy. If you have found a security problem in our website, your account, or the API behind them, this page tells you how to tell us, what we will do about it, and what you are allowed to test while you look.

Email us

Send your report to [email protected] with “Security” in the subject line. Please write in English.

We reply within 3 business days to confirm we have your report. We will keep you updated while we work on a fix, and we will tell you when it is live.

What to put in the report

The faster we can reproduce the problem, the faster it gets fixed. Please include:

1

The exact URL or API endpoint affected, and what goes wrong there.

2

Step-by-step instructions to reproduce it — a request, a script, or a short screen recording.

3

What an attacker could actually do with it, and the browser, OS or tool you used.

What you may test

In scope

  • The modernastro.com website
  • Sign-in, sign-up and account management
  • The API the website runs on
  • Subscription, checkout and billing flows

Not in scope

  • Services we only use, not run — Razorpay, Cloudflare, Google. Report those to them.
  • Scanner output with no working proof that it can be exploited
  • Missing security headers or weak TLS settings with no demonstrated impact
  • Self-XSS, or clickjacking on a page with nothing sensitive to click
  • Disagreements about our astrology calculations — those are welcome, but they are not security reports

Not sure whether something is in scope? Ask us before you test it.

Rules while you are testing

  • Use your own account and your own test data. Never read, change or delete anyone else's.
  • No denial-of-service, load testing or stress testing. It hurts real users and proves nothing we need proved.
  • No phishing, spam, or social engineering of our staff, our partners or our users. No physical attacks on anything.
  • Stop as soon as you have confirmed the problem. Prove it exists — don't see how far it goes.
  • If you do reach someone else's data by accident, stop, tell us, and delete your copy of it.
  • Give us 90 days to ship a fix before you write about it publicly. If it is taking longer, talk to us — we would rather agree a date than be surprised.

Our promise to you

If you follow the rules above, we treat your research as authorised. We will not pursue legal action against you, and we will not ask anyone else to. If someone else brings a claim against you over testing that followed this policy, we will say plainly that your work was authorised.

This holds even if you get it wrong. A report made in good faith that turns out to be a non-issue costs you nothing.

What you get

We are a small team and we do not run a paid bug bounty, so there is no cash reward. What we can offer is a fast, human reply, a real fix, and public credit on this page if you want it — just tell us the name or handle to use.

Acknowledgements

Our thanks to the researchers below, who reported a valid issue under this policy and agreed to be named. For each report we record when it reached us and when the fix shipped — that turnaround is the promise of this page made measurable.

  • 21 Aug 2026
    Dnyaneshwar Chandanshiv

    Signed-in sessions stayed valid after a password change.

    Reported 12:11 AM IST · fix shipped 4:08 AM the same night.

    Fixed in under 4 hours

For automated tools

Our machine-readable contact details follow RFC 9116.

/.well-known/security.txt →