AAIB web app passes security audit by CERT-IN empanelled firm

It matters to citizens as it attests to the security status of a government agency's online platform.

Who it concerns: Aircraft Accident Investigation Bureau (AAIB), G-Info Technology Solutions Pvt. Ltd., and the general public accessing the AAIB website (https://aaib.gov.in).

What the investigators found

• The audit was conducted from 06/03/2026 to 23/09/2026 using Black Box testing methods with tools including Kali Linux, Burp Suite Professional, and Nmap.
• The audit was performed in accordance with CERT-In, CWE, CIS/OWASP, and OSSTMM guidelines.
• The audited asset (https://aaib.gov.in) was found suitable for deployment/operation in accordance with industry best practices.
• All reported vulnerabilities were mitigated, except for a Cross-Origin Resource Sharing (CORS) issue which was accepted as an exception due to potential impact on existing website functionalities.
• The certificate is valid for one year from the issue date (23/09/2026) and remains valid only until changes are made to the implementation.
• The certificate is non-transferable to any third party without the express written consent of G-Info Technology Solutions Pvt. Ltd.

Also in the document

• G-Info Technology Solutions Pvt. Ltd. is identified as a CERT-IN Empanelled Organization with Empanelment no. 3(15)/2004-CERT-IN (VOL. XIV)-RE-2025-20.
• The certificate includes a clause stating the audit was undertaken on the belief that there are no ongoing legal cases or investigation proceedings pending against the project.
• The client (AAIB) agrees to indemnify and hold G-Info Technology Solutions Pvt. Ltd. harmless from any third-party claims arising from a breach of the client's obligations.