Vulnerability disclosure

Effective 29 August 2026

This page is the vulnerability-disclosure policy for the Law1 legal-research service at https://law1.in (the Service). It is an electronic record under the Information Technology Act, 2000. It does not need a physical or digital signature.

It is not ordinary product support. It is not a statutory grievance. It is not a request to unpublish or redact a judgment.

Machine-readable contact for this policy is at https://law1.in/.well-known/security.txt (RFC 9116).

1. Who we are

LAWONE SOLUTIONS PRIVATE LIMITED (we, us, Law1, or Lawone Solutions Pvt Ltd) operates the Service.

Registered office: 2nd Floor, A417, Lane 4, Road no 28, Ramnagar, Wagle Estate, MH, 400604, India. CIN: U58122MR2026PTC481366.

Other legal pages: Legal hub.

2. What to send here — and what not to

Send here (email [email protected], and put Security in the subject):

a security vulnerability in the Service, law1.in, or another system we operate for Law1.

Do not use this page as:

ordinary product, billing, or account support — use Contact or [email protected] without the Security subject;
a statutory grievance under DPDP, the IT Rules, or consumer rules — that follows Grievance officer;
a request to unpublish or redact a judgment — that follows Case and content removal.

3. Scope

This policy covers services and hostnames we operate for Law1, including law1.in and its subdomains.

It does not cover third-party products we use (for example Google sign-in, Razorpay, or Cloudflare) except to the extent a bug is in our integration. Report those products to their own disclosure channels.

4. How to report

Email [email protected]. Put Security in the subject so we can treat it as a vulnerability report and not as ordinary support or a grievance.

Include as much as you can:

a description of the issue;
steps to reproduce;
the potential impact;
URLs, request IDs, or other identifiers that help us find it.

We may need to verify that the report comes from you. Do not send passwords, one-time codes, session cookies, or dumps of other people’s data.

5. Safe harbor

We will not initiate legal action against researchers who:

act in good faith and follow this policy;
do not attempt to access, modify, or delete user data beyond what is needed to demonstrate the issue;
do not perform denial-of-service attacks;
do not use social engineering against our employees or users;
do not disrupt the availability of our services.

Good-faith research that stays inside those limits is welcome. This paragraph is not a licence to break the law, and it is not a bug-bounty programme. We do not promise a payment.

6. Prohibited

The following are not allowed under this policy:

exploiting a vulnerability to access, modify, or delete data you do not own;
denial-of-service or distributed denial-of-service;
social engineering of our staff or users;
any activity that disrupts the normal operation of the Service.

7. What happens next

We will acknowledge receipt of a complete report and will work on a fix. Those aims are operational. They are not a warranty, not an SLA, and not the statutory grievance clocks on Grievance officer.

We may ask for more detail. We may tell you when a fix has shipped. We do not promise a public advisory or a CVE for every report.