Guidelines for security researchers and users to responsibly discover and report potential vulnerabilities across Journi Trail™ DMC systems and platforms.
1. Commitment & Scope
Journi Trail™ prioritizes passenger data protection, booking security, and payment infrastructure integrity[cite: 104, 107]. This policy applies to vulnerabilities identified on:
- Core OTA domains (
*.journitrail.com). - Partner booking portals, APIs, and authenticated web applications.
- Mobile applications (iOS and Android) published by Journi Trail™ DMC.
2. Reporting Guidelines
Researchers discovering a security issue must:
- Submit full details privately to
security@journitrail.comimmediately upon discovery. - Provide reproduction steps, proof-of-concept (PoC) scripts, and targeted URLs.
- Keep vulnerability details strictly confidential until Journi Trail™ investigates and deploys a remediation patch.
3. Prohibited Testing
The following actions are strictly prohibited and will void safe harbor protection:
- Denial of Service (DoS/DDoS) attacks against servers or third-party airline/hotel APIs.
- Accessing, modifying, or deleting other travellers' PNRs, booking vouchers, or payment records.
- Spamming, social engineering, or phishing targeting employees or customer care agents.
- Exploiting payment gateways to initiate fraudulent refunds or bypass transactional charges.
4. Safe Harbor
If you perform research in good faith, act without extortion, and strictly follow this policy:
- Journi Trail™ will not pursue civil lawsuits or initiate criminal complaints against you.
- Your findings will be treated as authorized security testing under applicable Indian IT laws.
5. Response SLA & Timelines
- Acknowledgment: Within 48 hours of initial report receipt.
- Triage & Validation: Within 3 to 5 business days.
- Remediation: Fixes deployed based on CVSS severity scores.
- Public Recognition: Researchers adhering to responsible disclosure may be credited on our Security Hall of Fame upon mutual consent.
6. Security Contact Desk
Direct all vulnerability disclosures and security findings to:
Security Response Team: security@journitrail.com
Escalation Desk: director@journitrail.com