Disclosure guidelines
How we handle vulnerability reports — what you can expect from us, and what we ask in return. If you're testing in good faith and following the rules below, we've got your back.
Last updated: April 2026
InstaLaw will not pursue civil or criminal legal action against researchers who:
- Act in good faith and follow these guidelines
- Do not access, modify, or delete data belonging to other users
- Do not degrade service availability (no DoS/DDoS testing)
- Report findings promptly and allow reasonable remediation time
- Do not publicly disclose until we confirm the fix is deployed
- Do not use automated scanning tools at scale without prior coordination
Capture detailed reproduction steps, screenshots or video if applicable, and an assessment of the impact. The more detail you provide, the faster we can triage.
Use our web form at /report or email security@instalaw.io directly. If emailing, you may encrypt your report with our PGP key. Do not report vulnerabilities through public channels (GitHub issues, social media, etc.).
We will acknowledge receipt within the SLA window for the severity level. You will receive a tracking ID for your report.
We will keep you informed of our progress. If we need additional information, we will reach out. We aim to remediate within our target windows.
Once the fix is deployed and verified, we will coordinate public disclosure timing with you. With your permission, we will add you to our Hall of Fame.
We commit to the following response and remediation timelines:
| Severity | First Response | Remediation Target |
|---|---|---|
critical | 24 hours | 24 hours |
high | 24 hours | 7 days |
medium | 72 hours | 30 days |
low | 1 week | 90 days |
informational | Best effort | Discretionary |
InstaLaw is an early-stage product and we do not currently have the funding to operate a bug bounty program. We understand that security research takes real time and expertise, and we genuinely value every good-faith report we receive.
What we can offer today is public recognition on our Hall of Fame, a direct line to our engineering team, and our commitment to launching a formal bounty program as soon as our funding allows. Thank you for understanding.
The following activities are strictly prohibited and will void safe harbor protections:
- Denial of service attacks or resource exhaustion testing
- Accessing, downloading, or modifying other users' data
- Social engineering attacks against InstaLaw employees or users
- Physical attacks against InstaLaw infrastructure
- Automated vulnerability scanning at scale without coordination
- Testing against production systems with real user data
- Public disclosure before coordinated timeline agreement
- Submitting reports through third-party bounty platforms without prior arrangement
Contact
Email: security@instalaw.io
Need PGP? Mention it in your first email and we'll send a key before you share anything sensitive.