Cyber crime, scams and the law
What is happening, what to do in the first hour, and what the law says. Written with the Codesnag team of ethical hackers.
All articles
LawChildren's data under DPDP: parental consent for schools and edtech
The DPDP Act treats everyone under 18 as a child. What verifiable parental consent means, what the ban on tracking covers, and what schools, coaching centres and edtech apps should change before May 2027.
· 5 min read
LawDPDP Rules 2025: what a valid consent notice must say
The DPDP Rules, 2025 set out what an Indian app or website must tell people before asking for consent. Here is what the notice must contain, how withdrawal works, and where consent is not needed.
· 5 min read
LawDPDP Act and Rules 2025: what every Indian business must do now
The DPDP Rules were notified on 13 November 2025, and the main duties apply from 13 May 2027. Here is a plain guide for founders, CFOs, school and clinic owners, with a 12-point readiness checklist.
· 9 min read
Scam watchDigital arrest: what the Supreme Court's August 2026 order means for you
Complaints are falling, but digital arrest calls have not stopped. How the scam works, the warning signs, what to do in the first hour, and what the law says.
· 5 min read
Case studyDefending massive OTT data
A CERT advisory said the user data of India's largest regional OTT platform was for sale on the darknet. We were called in by referral, and had the sellers identified inside a week.
· 6 min read
Case studyThe urgent call to Codesnag
A zero-day against a smart-LED brand's IoT estate took every service down and wiped its cloud servers. Control was restored in three days — and the mobile apps turned out to be the way in.
· 5 min read
MethodInside a Codesnag engagement
An IDOR in a hotel chain's payment flow was being used to book rooms and club events at prices nobody agreed to. Their own security team could not find it. Here is how the engagement actually ran.
· 7 min read