Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in any MS TICKS system, please report it responsibly by emailing support@msticks.pk with the subject line Security Disclosure. Include a clear description, steps to reproduce, and any proof-of-concept where relevant.

What We Ask of You

• Give us 90 days from the date of your report to investigate and remediate before any public disclosure.
• Do not access, copy, modify, or delete user data beyond what is necessary to demonstrate the issue.
• Do not disrupt or degrade the availability of our production services.
• Do not perform social engineering, phishing, or physical attacks against our team or customers.
• Do not submit automated scans without prior written permission.

What You Can Expect from Us

• Acknowledgement of your report within 3 business days.
• Regular updates on our investigation progress.
• Credit in our acknowledgements (if you wish) once the issue is resolved.
• We will not pursue legal action against researchers acting in good faith under this policy.

Scope

The following are in scope:

• https://msticks.pk and all subdomains
• MS TICKS web application and checkout flow
• Order management and payment processing endpoints

The following are out of scope:

• Third-party services (Resend, AWS, GitHub)
• Denial-of-service attacks
• Issues already known to us
• Social engineering and physical attacks

Safe Harbour

MS TICKS considers security research conducted under this policy to be authorised conduct. We will not initiate legal action against researchers who comply with these guidelines. If a third party initiates legal action in connection with activities conducted under this policy, we will take steps to make known that your actions were conducted in compliance with this policy.

Contact

To report a vulnerability, email support@msticks.pk with subject line Security Disclosure. For general enquiries, use our contact page.

Our security.txt is available at the standard RFC 9116 location.