Security Policy

Account protection

• Passwords are hashed with salted scrypt and compared in constant time.
• Sessions are bounded, recorded server-side, and validated on every request.
• You can review your devices and revoke any session, including all other sessions at once.
• Changing your password invalidates every existing session.
• Sign-in, registration, password reset, and verification endpoints are rate limited.
• Password recovery and verification links are hashed, single-use, and expire.

Platform protection

• Every protected operation is authorised on the server, not only in the interface.
• Recruiter access is scoped to company membership and re-checked on each request.
• All external input is schema-validated before use.
• Database access uses parameterised queries through an ORM.
• Material hiring, permission, and privacy changes are recorded in an audit log.

Reporting a vulnerability

Report suspected vulnerabilities to security@internshift.in. Include the affected URL, the steps to reproduce, and the impact you observed.

• We acknowledge reports and keep you informed while we investigate.
• Please give us reasonable time to remediate before public disclosure.
• Do not access, modify, or delete data that is not yours.
• Do not run denial-of-service, spam, or social-engineering tests against our users or staff.

Good-faith research

We will not pursue action against researchers who follow this policy, act in good faith, and avoid privacy violations and service disruption. We do not currently operate a paid bounty programme.

If your account is at risk

Reset your password immediately and revoke all other sessions from your security settings, then contact us if you still see unfamiliar activity.