Responsible Disclosure Policy

NEXTSTEP is committed to maintaining the security, integrity, availability, and confidentiality of its website, systems, applications, services, and user information.

NEXTSTEP values the efforts of security researchers, ethical hackers, students, professionals, and members of the cybersecurity community who responsibly identify and report potential security vulnerabilities.

This Responsible Disclosure Policy establishes guidelines for reporting security vulnerabilities in a manner that protects users, data, and systems while enabling timely remediation.

This Policy applies to security vulnerabilities discovered in:

• The NEXTSTEP website;
• Web applications operated by NEXTSTEP;
• Student and participant portals;
• Career development platforms;
• Internship facilitation systems;
• Learning and educational resources managed by NEXTSTEP;
• Other digital assets owned and controlled by NEXTSTEP.

This Policy does not apply to third-party systems, websites, applications, platforms, or services that are not owned or controlled by NEXTSTEP.

If you discover a potential security vulnerability, please report the issue promptly by sending an email to:

Email: info@nextstep.ac

Reports should include, where possible:

• Detailed description of the vulnerability;
• Affected URL, page, application, or system;
• Steps required to reproduce the issue;
• Potential impact or security risk;
• Proof-of-concept evidence where appropriate;
• Screenshots or supporting documentation;
• Contact details for follow-up communication.

Providing complete information helps NEXTSTEP assess and remediate vulnerabilities more efficiently.

Individuals conducting security research under this Policy agree to:

• Act in good faith;
• Avoid causing harm to systems, services, or users;
• Respect user privacy;
• Limit testing to the minimum necessary to validate a vulnerability;
• Avoid exploitation beyond what is necessary to demonstrate the issue;
• Immediately discontinue testing if unintended access to sensitive information occurs;
• Refrain from publicly disclosing vulnerabilities before remediation has been completed or authorized by NEXTSTEP.

The following activities are strictly prohibited and fall outside the scope of this Policy:

• Accessing, downloading, copying, modifying, deleting, or disclosing data belonging to other users;
• Attempting account takeover;
• Social engineering attacks;
• Phishing attacks;
• Physical attacks against facilities or personnel;
• Denial-of-service (DoS) attacks;
• Distributed denial-of-service (DDoS) attacks;
• Ransomware deployment;
• Malware deployment;
• Data extraction or exfiltration;
• Privilege escalation intended to obtain unauthorized access;
• Destruction, modification, or corruption of data;
• Extortion attempts;
• Public disclosure of vulnerabilities before remediation;
• Any activity that violates applicable law.

Any activity causing service disruption, legal violations, financial loss, or user harm is strictly prohibited.

Upon receiving a report, NEXTSTEP may:

1. Acknowledge receipt of the report;
2. Review the information provided;
3. Assess the severity and impact of the vulnerability;
4. Investigate and validate the reported issue;
5. Take reasonable corrective measures where appropriate;
6. Communicate with the reporter when necessary.

NEXTSTEP reserves the right to determine prioritization, remediation timelines, and resolution approaches at its sole discretion.

Unless expressly agreed in writing, submission of a vulnerability report does not create any entitlement to:

• Financial compensation;
• Rewards;
• Bug bounty payments;
• Employment opportunities;
• Consulting engagements;
• Public recognition.

NEXTSTEP may, at its sole discretion, acknowledge contributions where deemed appropriate.

NEXTSTEP generally will not pursue legal action against individuals who:

• Comply with this Responsible Disclosure Policy;
• Act in good faith;
• Avoid privacy violations;
• Avoid service disruption;
• Avoid unauthorized data access;
• Promptly report discovered vulnerabilities;
• Allow reasonable time for remediation before any disclosure.

This Safe Harbor provision applies only to activities conducted strictly within the scope of this Policy.

The Safe Harbor provision shall not protect any individual who:

• Violates applicable laws;
• Extracts, stores, shares, or misuses data;
• Causes system disruption;
• Exceeds authorized testing boundaries;
• Acts maliciously or recklessly.

All vulnerability information shared with NEXTSTEP should be treated as confidential until:

• The vulnerability has been remediated; and
• NEXTSTEP has authorized disclosure in writing.

Researchers agree not to disclose vulnerability information to third parties without prior written authorization from NEXTSTEP.

NEXTSTEP shall not be liable for:

• Any losses incurred by a researcher;
• Costs associated with testing activities;
• Damages arising from participation in vulnerability research;
• Consequences arising from actions outside the scope of this Policy.

Researchers assume full responsibility for ensuring compliance with applicable laws and regulations.

NEXTSTEP reserves all legal rights and remedies available under applicable laws.

Nothing in this Policy shall:

• Waive any legal rights;
• Grant unrestricted authorization to perform testing;
• Permit unlawful activities;
• Limit NEXTSTEP's ability to protect its systems, users, or data.

NEXTSTEP reserves the right to modify, suspend, or terminate this Policy at any time without prior notice.

Researchers are responsible for ensuring compliance with all applicable laws, including but not limited to:

• Digital Personal Data Protection Act, 2023;
• Information Technology Act, 2000;
• Applicable cybercrime laws;
• Data protection and privacy laws;
• Intellectual property laws.

Any conduct violating applicable laws may be reported to relevant authorities.

This Responsible Disclosure Policy shall be governed by and construed in accordance with the laws of India.

Any dispute relating to this Policy, website security, vulnerability disclosure activities, or interactions arising under this Policy shall be subject to the exclusive jurisdiction of the competent courts located in Purba Bardhaman, West Bengal, India.

NEXTSTEP

Website: https://nextstep.ac

Email: info@nextstep.ac

For vulnerability reporting and security-related communications:

info@nextstep.ac

NEXTSTEP appreciates responsible security research and encourages good-faith reporting of potential vulnerabilities. Working together helps maintain a safer environment for students, educators, professionals, partners, and all users of the NEXTSTEP platform.