Rexscot delivers enterprise-grade penetration testing, VAPT assessments, and application security consulting for organisations that cannot afford to be breached.
Our Discipline
We believe that meaningful security can only come from people who think like attackers. Automation has its place; judgment does not scale.
Capabilities
Rexscot conducts security assessments across every layer of the modern application stack — from network perimeter to business logic.
Engagement Process
A structured, seven-phase process that ensures nothing is missed from initial reconnaissance through to verified remediation.
Why Rexscot
Report Quality
Every report includes an executive summary for leadership, a complete technical report for engineering teams, CVSS-scored findings, working proof-of-concept code, and step-by-step remediation guidance.
Client Feedback
Onboarding
A structured onboarding process that removes ambiguity from the very first conversation.
Standards and Ethics
Pricing
Common Questions
Begin
No commitment required for an initial consultation. Tell us about your business and we will recommend the right assessment.
Capabilities
From perimeter to business logic, Rexscot conducts manual assessments across web, API, mobile, and desktop applications.
01 — Web Application
Deep-dive manual testing against the OWASP Testing Guide — uncovering vulnerabilities that automated scanners cannot detect, including business logic and authentication flaws.
02 — API Security
03 — Mobile Security
Android application assessments covering static analysis, dynamic testing, and backend API communication review.
04 — Desktop
Windows and Electron application assessments — local privilege escalation, insecure credential storage, DLL hijacking, and update mechanism review.
05 — VAPT
Comprehensive VAPT engagements covering your full attack surface — internal networks, external perimeter, web applications, and mobile — in a single structured programme.
Get Started
Tell us about your organisation and we will recommend the right engagement.
About Rexscot
Rexscot was founded with the conviction that thorough, human-led security testing should not be limited to organisations with eight-figure security budgets.
Our Story
We witnessed too many growing businesses treat security as a compliance checkbox rather than an operational requirement. Not because they were careless, but because serious testing felt inaccessible.
Rexscot was built to close that gap. We bring the same depth of security assessment that large enterprises receive to startups and scale-ups who carry equivalent exposure — often with less internal capacity to detect or respond to a breach.
Every engagement is conducted by practitioners who approach your systems the way an adversary would. Findings are communicated clearly enough for engineers to act on them and for leadership to understand what was at stake.
The Team
Mission and Vision
To proactively secure organisations through rigorous offensive security testing and actionable remediation guidance — converting discovered vulnerabilities into strengthened defences.
A digital ecosystem in which businesses of every scale can build and operate with confidence, knowing their security posture is continuously tested and genuinely resilient.
Core Values
Contact us to discuss your requirements. No commitment for the initial consultation.
Client Reviews
Verified outcomes from completed engagements.
Collaboration
Researchers, developers, startups, and organisations building in the security space — we are open to meaningful collaboration.
Who We Work With
Send an Enquiry
Fill in the form and we will respond within one business day to discuss whether there is a productive fit.
Contact
Complete the form and we will respond within one business day. All enquiries are treated as confidential.
Classification: Public
Rexscot welcomes responsible security research. This policy defines how to report vulnerabilities affecting Rexscot's own systems and what researchers can expect from us.
Send a detailed report to our security contact. We take every responsible disclosure seriously.
01
Rexscot is a cybersecurity consulting firm that provides penetration testing, vulnerability assessment, and security consulting services to organisations across India and internationally. We take the security of our own systems and public-facing assets seriously.
This Vulnerability Disclosure Policy (VDP) establishes a clear and transparent process for security researchers, users, customers, and members of the broader security community to responsibly report suspected vulnerabilities affecting Rexscot's own published in-scope assets.
Rexscot believes in the value of responsible security research and recognises that external researchers may sometimes identify potential security issues before internal teams.
This policy applies exclusively to Rexscot's own published in-scope assets. It does not cover client systems, client infrastructure, or third-party services. Separate engagement documentation governs all client security testing.
02
The following Rexscot-operated assets are within the scope of this policy. Researchers should verify current scope before conducting any testing.
| Asset Type | Asset / Identifier | Notes |
|---|---|---|
| Primary Website | https://rexscot.com | Public-facing site |
Scope may be updated periodically. Always verify current in-scope assets before testing. If uncertain, contact all@rexscot.com before conducting any testing.
Rexscot relies on various third-party providers. These systems are not within scope. Researchers who identify a vulnerability in a third-party system that affects Rexscot may report it to the relevant vendor directly and notify Rexscot separately at all@rexscot.com.
Important: Rexscot provides security testing services to client organisations. A researcher must not assume that any client domain, application, server, IP address, API, or cloud account is authorised for testing merely because Rexscot works with that organisation. Client systems require separate, written authorisation. Testing client systems without authorisation may constitute a criminal offence.
03
| Channel | Details |
|---|---|
| Security Email | all@rexscot.com |
| Website | https://rexscot.com |
| Critical Reports | Use subject line: [CRITICAL SECURITY REPORT] |
Rexscot recommends researchers use encrypted communication where possible.
04
A complete, well-structured report enables Rexscot to validate and remediate findings efficiently.
| Field | Required | Description |
|---|---|---|
| Researcher Name / Alias | Optional | May be withheld for anonymity |
| Contact Email | Required | For follow-up and status updates |
| Affected Asset | Required | Domain, URL, application, or service identifier |
| Vulnerability Type | Required | e.g. SQL Injection, XSS, IDOR, Auth Bypass |
| Description | Required | Clear explanation of the vulnerability and its behaviour |
| Preconditions | Recommended | Authentication state, required permissions, etc. |
| Reproduction Steps | Required | Exact step-by-step instructions to reproduce the issue |
| Proof of Concept | Recommended | Code, payload, screenshot, or HTTP request/response |
| Affected Endpoints / URLs | Required | Exact URLs, API endpoints, or parameters affected |
| Business Impact | Recommended | What could an attacker achieve by exploiting this? |
| Timestamp / Timezone | Recommended | When the issue was discovered and tested |
| Test Accounts Used | If applicable | Any test accounts used — do not submit passwords |
Minimise sensitive data in reports. Do not submit production credentials, private keys, API secrets, or third-party personal data.
05
Researchers are expected to conduct vulnerability discovery responsibly and minimise potential harm to Rexscot systems, data, and users.
06
Within the published scope defined in Section 2A, the following types of low-impact research activities may be acceptable:
Submitting a vulnerability report does NOT authorise broader security testing. Research not covered by published scope requires separate written authorisation from Rexscot.
07
The following activities are explicitly prohibited under this policy regardless of intent:
08
09
Rexscot uses third-party services as part of its operations. Third-party infrastructure is not automatically within scope.
Researchers who identify a vulnerability involving a third-party provider should report directly to the relevant vendor's own disclosure programme and may notify Rexscot separately where the issue has direct implications for Rexscot's security posture. Do not exploit or pivot through third-party vulnerabilities to attack Rexscot or its clients.
10
This section is critical. Rexscot provides penetration testing and security consulting to client organisations. As a result, Rexscot may be associated with a wide range of client domains, applications, and infrastructure.
A vulnerability researcher must not assume that any of the following are authorised for testing under this policy:
Any security testing of client systems requires a separate, written Authorisation to Test signed by the relevant client, together with a formal Rexscot engagement agreement. Submitting a contact form or vulnerability report to Rexscot does not constitute client authorisation.
Unauthorised testing of client systems may constitute a criminal offence under applicable Indian and international law.
11
Rexscot does not commit to fixed response or remediation timelines. Response times may vary depending on report volume, severity, and operational capacity.
12
Rexscot may communicate with researchers at various stages:
Rexscot does not guarantee a response to every report. Duplicate, out-of-scope, and invalid reports may not receive an individual response. All communications should be directed to all@rexscot.com.
13
Reports involving any of the following should be clearly marked as [CRITICAL SECURITY REPORT] in the subject line:
Send to all@rexscot.com with subject: [CRITICAL SECURITY REPORT]
14
Rexscot requests that researchers allow reasonable time to investigate, validate, and remediate reported vulnerabilities before any public disclosure.
Researchers are encouraged to coordinate disclosure timing with Rexscot. Premature public disclosure of an unpatched vulnerability may harm Rexscot's clients, users, and security posture.
Where coordinated disclosure is agreed, Rexscot may consider acknowledging the researcher's contribution, subject to operational and legal considerations. Rexscot does not guarantee public credit, CVE assignment, hall-of-fame listing, or blog recognition.
Rexscot does not impose a mandatory embargo period. Researchers are asked to act in good faith and contact all@rexscot.com to discuss disclosure timing.
15
Following remediation, Rexscot may consider coordinated public disclosure where appropriate and where the researcher has acted in accordance with this policy.
Rexscot does not promise: public credit or attribution, CVE ID assignment, hall-of-fame listings, blog posts about specific reports, or monetary compensation of any kind.
This policy is not a bug-bounty programme. No financial rewards are offered or implied.
16
Multiple researchers may independently identify the same underlying vulnerability. Rexscot may classify subsequent reports as duplicates and will acknowledge them where practical.
Reports may be classified as out-of-scope or invalid where they involve assets not in published scope, third-party or client systems, theoretical issues without reproducible evidence, automated scanner output without manual validation, or informational observations without security impact.
17
Legal Review Required
This section reflects Rexscot's intended approach and has not been reviewed by qualified legal counsel. It does not constitute a legal guarantee or binding commitment. Applicable Indian and international law may still apply.
Rexscot does not intend to pursue legal action against researchers who:
This section does not: authorise testing outside published scope, override applicable law, waive the legal rights of third parties including Rexscot's clients, create a contractual relationship, or constitute a legal defence against criminal or civil proceedings.
18
Legal Review Required
Data handling obligations under applicable privacy law (including the DPDP Act) should be reviewed by qualified legal counsel.
Researchers who submit reports are expected to:
Rexscot will treat vulnerability reports submitted in good faith with appropriate confidentiality. Rexscot does not guarantee absolute confidentiality in all circumstances, including where legal or regulatory obligations may require disclosure.
19
Rexscot acknowledges that researchers may use AI-assisted tools and workflows. The following principles apply:
20
High-quality reports enable faster triage and remediation. A useful report includes:
Reports that are vague, non-reproducible, or rely solely on automated scanner output without manual validation may be deprioritised or classified as informational.
21
This Vulnerability Disclosure Policy:
All formal security testing engagements require a separate Master Services Agreement, Statement of Work, and signed Rules of Engagement / Authorisation to Test document.
22
Rexscot may update this Vulnerability Disclosure Policy from time to time. The current version is published at https://rexscot.com/security and /.well-known/security.txt.
Changes are effective from the date indicated in the document control table. Researchers are encouraged to review the current version before submitting reports.
23
| Detail | Information |
|---|---|
| Organisation | Rexscot — Cybersecurity Consulting |
| Security Contact | all@rexscot.com |
| Website | https://rexscot.com |
Include the affected asset, vulnerability type, reproduction steps, and proof of concept.
24
| Version | Date | Change | Owner | Status |
|---|---|---|---|---|
| 1.0 | 2025 | Initial draft | Rexscot | Draft |
Classification: Public
This policy explains what information Rexscot collects through this website, how it is used, and how to contact us about privacy matters.
01
This Privacy Policy explains how Rexscot ("Rexscot", "we", "us") collects, uses, and protects information in connection with the website at rexscot.com ("the Website").
Rexscot is a cybersecurity consulting firm providing penetration testing, vulnerability assessment, and security consulting services.
For questions about this policy or how your information is handled, contact us at all@rexscot.com.
02
This policy applies to:
This Website Privacy Policy does not replace contractual confidentiality or data-processing terms contained in a Non-Disclosure Agreement, Master Services Agreement, Statement of Work, Rules of Engagement, or other signed engagement documentation. Where a client relationship is governed by such documents, those documents may contain additional or more specific terms.
03
When you submit a form on this Website, we receive the information you enter into that form.
| Form | Fields Collected |
|---|---|
| Contact Form | Name, company, email address, website/application URL, service required, budget range, preferred contact method, project description |
| Collaborate Form | Name, email address, collaboration type, proposal description |
Both forms are processed via Netlify Forms (see Section 10). We do not ask for passwords, payment details, or government ID numbers through these forms, and you should not submit them.
The Website itself does not run first-party analytics or tracking scripts, and does not set cookies or use browser local/session storage to identify or track visitors.
Standard web server and hosting-infrastructure logs (for example, IP address, request timestamp, and browser user-agent string) may be generated by our hosting provider as part of normal web server operation and basic security monitoring. These are infrastructure-level logs rather than data actively collected by the Website's own code.
We do not currently receive personal information about you from third-party data brokers or marketing partners. Form submissions are relayed to us by our form-processing provider (Netlify) as described in Section 10.
If you email us directly, or submit a vulnerability report, the content of that communication — including any technical details, attachments, or personal information you choose to include — is received and retained as described in Sections 5 and 12.
04
When you submit the Contact form, request a service, request collaboration, or email us directly, we use the information provided to respond to you and evaluate your enquiry. This is distinct from a security vulnerability report — see Section 5.
Email sent to all@rexscot.com is received directly by Rexscot; the content and any attachments you send are retained as part of normal business correspondence.
05
Security researchers may submit vulnerability reports under our Vulnerability Disclosure Policy. Vulnerability reports may contain technical information (such as affected endpoints, request/response data, or proof-of-concept code) and, depending on what the researcher chooses to submit, personal information.
Researchers should not submit passwords, private keys, API secrets, unnecessary personal data, unnecessary production data, or confidential third-party information as part of a report.
This Privacy Policy does not weaken or replace the reporting process, scope restrictions, or safe-harbor language set out in the Vulnerability Disclosure Policy at rexscot.com/security.
06
We use the information described in Section 3 for the following specific purposes:
We do not use the information collected through this Website for advertising, profiling, or automated decision-making, and we do not sell it — see Section 11.
07
Legal Review Required
The applicable legal framework for this processing, and the precise lawful grounds under that framework, have not yet been confirmed by qualified legal counsel.
In general terms, we process information provided through Website forms and direct email on the basis that it is necessary to respond to your enquiry or request, to take steps toward a potential business engagement at your initiative, to receive and act on security reports in the public interest of responsible disclosure, and to comply with applicable legal obligations.
Where the Digital Personal Data Protection Act, 2023, or other Indian law applicable to Rexscot uses terminology different from other frameworks (such as the EU GDPR), we describe our practices using the terminology of the law that actually applies rather than assuming GDPR concepts apply by default.
08
This Website does not set first-party cookies, and its own code does not use browser local storage or session storage to track or identify visitors.
Netlify, which hosts this Website and processes form submissions, may set a functional cookie or token as part of its Netlify Forms anti-spam and submission-handling mechanism when a form is submitted. This is limited to form-processing functionality rather than tracking or advertising.
Because the Website does not use analytics, advertising, or tracking cookies, no cookie-consent banner is currently presented. This will be reviewed if the Website's technology changes.
09
This Website does not currently run any analytics platform (such as Google Analytics or similar). No visitor-behaviour tracking script is loaded by the Website. If this changes in the future, this Privacy Policy will be updated to name the provider, the information it processes, and any controls available to visitors.
10
The Website relies on the following third-party services to operate:
| Provider | Purpose | Information Involved |
|---|---|---|
| Netlify | Website hosting and form submission processing (Contact and Collaborate forms) | Form field data you submit; standard hosting request logs |
| Google Fonts | Web font delivery (Playfair Display, DM Sans) | Standard font-request connection data (IP address, browser type) per Google's practices |
| cdnjs (Cloudflare) | Delivery of Three.js and GSAP JavaScript libraries used for visual effects | Standard script-request connection data |
| Hostinger | Domain name registration for rexscot.com | Domain registration data (not visitor data) |
These providers process information according to their own privacy policies. Rexscot does not control, and is not responsible for, the internal data practices of these third parties. We selected them for their function (hosting, fonts, script delivery) rather than for any data-collection capability.
11
We do not sell personal information collected through this Website, and we do not share it with third parties for their own marketing purposes.
Information may be shared in the following limited circumstances:
12
We retain information collected through this Website only for as long as reasonably necessary for the purposes described in Section 6, including:
Legal Review Required
Exact retention periods for each data category are [RETENTION PERIOD TO BE CONFIRMED] and will be finalised as part of legal review.
13
As a cybersecurity consulting firm, we take reasonable, appropriate measures to protect information submitted through this Website, consistent with the confidentiality and evidence-handling principles applied in our client engagements. These measures may include:
No method of transmission or storage is completely secure. We do not claim that any system is "100% secure," and we do not hold any specific security certification (such as ISO 27001 or SOC 2) for this Website unless separately confirmed and documented.
14
Rexscot takes reasonable steps to protect information handled through this Website. In the event of a security incident affecting personal information, we will respond in accordance with applicable law and our internal procedures.
Legal Review Required
We do not commit to a specific notification timeframe (such as "within 24 hours") in this policy. Applicable breach-notification obligations under Indian law will be confirmed through legal review.
15
Depending on the law applicable to the processing of your information, you may have rights such as requesting access to, correction of, or deletion of information you have provided to us.
Legal Review Required
The exact set of rights available to you, and the process for exercising them, depends on the specific legal framework that applies (for example, the Digital Personal Data Protection Act, 2023, where applicable) and will be confirmed through legal review rather than assumed from other jurisdictions' frameworks.
To make a request regarding your information, contact us at all@rexscot.com.
16
This Website is a business-to-business and professional services website and is not directed at, or designed for, children. We do not knowingly collect personal information from children through this Website.
17
Rexscot operates from India. Some third-party service providers described in Section 10 (such as Netlify and Google Fonts) may process or route data through infrastructure located outside India as part of their global service delivery.
We rely on these providers' own security and privacy practices for such processing. We do not have confirmed details of every specific data-routing location for every provider, and this section will be updated with more specific information as it is confirmed.
18
Information processed during a formal client engagement — including scope details, findings, evidence, and reports — is governed by the relevant signed engagement documentation, which may include a Non-Disclosure Agreement, Master Services Agreement, Statement of Work, Rules of Engagement, and, where applicable, a data-processing agreement.
This Website Privacy Policy describes our practices for the public Website only and is not a substitute for the complete data-processing terms of a client engagement.
19
Rexscot may use AI-assisted tools as part of appropriate internal business and security research workflows, consistent with the AI-assisted reporting principles described in our Vulnerability Disclosure Policy.
We do not claim that every Website submission or communication is processed by AI, that every vulnerability report is sent to an AI provider, or that no human review occurs. Use of AI tools, where it occurs, is limited to appropriate internal workflows.
Rexscot does not send confidential client data or sensitive information to external AI systems outside of a documented, appropriate workflow.
20
This Website may link to external websites, including third-party services referenced in Section 10. Rexscot is not responsible for the content or privacy practices of external websites. We encourage you to review the privacy policy of any external website you visit.
21
| Detail | Information |
|---|---|
| Privacy Contact | all@rexscot.com |
| General Contact | all@rexscot.com |
| Website | https://rexscot.com |
Rexscot does not currently have a dedicated privacy-specific mailbox separate from its general business contact address.
22
We may update this Privacy Policy from time to time to reflect changes in our practices, the technologies used on this Website, or applicable law. The current version is always published at rexscot.com/privacy.
| Version | Effective Date | Last Updated | Status |
|---|---|---|---|
| 1.0 | [ POLICY EFFECTIVE DATE ] | [ LAST UPDATED ] | Draft |
23
Legal Review Required
Governing law and jurisdiction for this policy will be confirmed once Rexscot's legal entity structure and registered address are finalised. This section will be completed following legal review rather than an assumed jurisdiction.
24
Primarily what you provide directly through the Contact or Collaborate forms, or by emailing us — see Section 3. We do not run analytics or use tracking cookies.
Email all@rexscot.com — see Section 21.
Review the Vulnerability Disclosure Policy at rexscot.com/security and email all@rexscot.com with the appropriate subject line.
No. It applies only to Rexscot's own published in-scope assets. Client systems require separate written authorisation — see Section 2D of the Vulnerability Disclosure Policy.
Email all@rexscot.com — see Section 15 (Your Rights) and Section 21 (Privacy Contact).