1. How we protect data
- Encryption in transit (HTTPS) and managed encryption at rest in our database.
- Passwords stored as bcrypt hashes. One-time codes are hashed, expire in 10 minutes and lock after 5 wrong tries.
- Sign-in with Google and GitHub uses PKCE and state checks. Optional two-step sign-in by email code.
- Permission checks on every protected request, rate limiting, spam controls and safe handling of links (blocking private network addresses).
- AI input and output is treated as untrusted and validated before use.
- Sensitive admin actions are written to an audit trail.
2. Report a vulnerability
Email admin@vigotech.in with a clear description, steps to reproduce and impact. See also security.txt. Please do not include real user data. We acknowledge reports within 3 working days.
3. Scope and safe harbour
In scope: skilion.vigotech.in and its APIs. Out of scope: social engineering, physical attacks, denial of service and third-party services.
If you act in good faith, avoid privacy harm and service disruption, test only against your own accounts and give us reasonable time to fix before disclosure, we will not pursue legal action against you.
4. If your account may be compromised
Reset your password, review connected accounts in Settings, Security, and contact us. We will help you secure the account and tell you what we know.