If you believe you have found a security vulnerability in any Ninjacart system, please report it first to admin@ninjacart.com. If you do not receive a response within five working days, you can write to queries@ninjacart.com.
Please include the affected URL or endpoint, steps to reproduce the issue, and its potential impact. We ask that you limit testing to the minimum needed to demonstrate the vulnerability, avoid accessing or modifying data belonging to others, and refrain from public disclosure until we have had a reasonable opportunity to remediate.
We will acknowledge every report, investigate it through our standard vulnerability management process, and keep you informed until the issue is closed. Ninjacart does not operate a paid bug bounty programme, but we are happy to credit researchers who report valid issues. Researchers acting in good faith under this policy will not face legal action from Ninjacart.