• Always conduct testing ethically and legally.
• Do not publicly disclose the vulnerability without obtaining explicit consent from Nippon Life India Asset Management Limited.
• Never attempt to access, modify, delete, or store user data.
• If using automated tools or scripts, ensure they do not cause harm or excessive traffic to our platforms.
• Use only your own accounts for testing. Do not interact with or exploit other real users' accounts.
• If you find multiple vulnerabilities, report them sequentially and not simultaneously, giving us time to respond.
• Do not conduct tests that may degrade our services or impact our users.
• You will not publicly disclose a bug/vulnerability before it has been fixed or explicit written approval from NAM India
• You will not violate any laws or regulations. NAM India will not be responsible for non-adherence of laws from your end.
• You will protect our users' privacy and data. You will not access or modify data without our permission
• You will ensure no disruption to our production systems and no destruction of data during security testing
• If any privacy violation is inadvertently caused by you while testing, you are liable to disclose it immediately to us
• You will abstain from exploiting a security issue/vulnerability you discover for any reason.
• At times, we may take a reasonable time to fix the vulnerability reported by you. You have to allow us time to respond to you.
• If you disclose a bug/security issue via any social media platform, you will be rendered ineligible for this program.
• Do not access, modify, or delete any data in our systems. Discovery of vulnerabilities should not include unauthorized access to personal or proprietary information.
• Testing must be limited to accounts/data owned by the researcher.

• Age: Participants must be 18 years or older at the time of entry.
• Affiliation: Individuals affiliated with Nippon Life India Asset Management Limited, including employees, contractors, and their immediate families, are not eligible to participate.
• Country of Residence: While we accept submissions globally.
• Compliance: Researchers must be in full compliance with all terms and conditions of the Nippon Life India Asset Management Limited Bounty Initiative.

• Denial of Service (DoS/DDoS) Attacks: Any attempts to disrupt the service is strictly prohibited.
• Physical Security: Physical attacks against offices, data centers, or any other physical assets.
• Third-party Platforms: Vulnerabilities in third-party components or services used by Nippon Life India Asset Management Limited but not under our direct control.
• Social Engineering: This includes spear-phishing, pretexting, baiting, and any other form of obtaining information through deception.
• Issues related to software or protocols not under Nippon Life India Asset Management Limited control.
• Unconfirmed Reports: Reports without a clear proof-of-concept or lacking detailed steps to reproduce.
• Automated scanning tools are marked as out of scope of the program.
• Issues related to outdated browsers or unsupported devices.
• Self XSS, clickjacking and rate limiting observations without any impact / exploitability are to be closed as out of scope.
• Physical Attacks
• Issues related to outdated browsers or unsupported devices or Outdated browsers/devices
• Missing security headers
• CORS, HSTS, and outdated software for which public exploits do not exist
• HttpOnly flag not set on cookies
• Missing HTTP security headers that do not directly lead to exploitable conditions
• restore.nipponindiaim.com, dev.nipponindiaim.com, backup.nipponindiaim.com and test.nipponindiaim.com are honeypots and are of out of scope for security assessment.

Carefully review and understand the rules and scope of the bug bounty program. Each program has specific guidelines, eligibility criteria, and a defined scope of systems, applications, or services that are in-scope for testing. Focus your efforts on these areas to ensure your findings are eligible for rewards.

When reporting a vulnerability, commit to providing clear and comprehensive details to help the organization reproduce and validate your findings. Include step-by-step instructions, proof-of-concept code if applicable, and any other relevant information that can assist the organization's security team in understanding and verifying the issue.

Engage in professional communication with the organization's security team. Be responsive to any requests for clarification, additional information, or coordination during the vulnerability verification process. Maintain open and respectful communication throughout the entire process, understanding that both parties are working together to improve security.

Always adhere to responsible disclosure practices. When you discover a vulnerability, avoid exploiting it for malicious purposes or sharing it with unauthorized parties. Instead, immediately report the vulnerability to the program organizers following the reporting process outlined in the program guidelines. This allows the organization to address the issue before potential harm can occur.

Researchers participating in our programs are expected to adhere to specific Safe Harbor provisions. They are assured Legal Protection; by complying with all program terms, they're granted a legal safe harbor, ensuring they won't face lawsuits or legal actions for their reported findings. Participants also commit to Responsible Disclosure, providing ample time to address and rectify vulnerabilities and doesn't disclose any findings publically what so ever. Testing should be confined only to systems they have explicit authorization to assess. Furthermore, during the assessment, data access should be minimized, focusing only on what's necessary to validate a vulnerability, and retaining no user data beyond what is absolutely required.