Reporting a security problem

If you think you have found a security problem in Lawki, please tell us privately so we can fix it before anyone misuses it. Thank you for helping keep Lawki and the people who use it safe.

How to report

Email [CONFIRM: support email address] with “Security” in the subject. Please include:

• what the problem is and where it is (a page, a part of the app, or a request);
• the steps to see it, and what an attacker could do with it;
• how we can reach you, if you want us to.

Please do not put other people’s personal information in your report. If you came across any, tell us that you did, not what it was.

What is covered

• This website, lawki.app.
• The Lawki iPhone app.
• Lawki’s own server functions and database.

Problems in the services Lawki uses, such as CourtListener, Supabase, Cloudflare, Resend or Apple, belong to those companies: please report them to them directly.

What we ask

• Use only accounts you made yourself, and do not try to read, change or delete anyone else’s data.
• Stop as soon as you can show the problem, and do not keep any data you reached.
• Do not slow down or disrupt Lawki, for example with automated scans or floods of requests, sign-in codes or emails.
• Do not try to trick or pressure people, including the Lawki team.
• Give us a reasonable time to fix the problem before you tell anyone else about it.

What we do

A person on the team reads every report. We will tell you once the problem is solved, if you gave us a way to reach you. [CONFIRM: how quickly Lawki acknowledges and answers a security report].

Lawki has no bug bounty and does not pay for reports.

[CONFIRM: safe-harbor wording for good-faith security research (lawyer to write)].

security.txt

The same contact details are in lawki.app/.well-known/security.txt, in the standard format for security contacts.