We take the security of lawyers’ data seriously and welcome reports from security researchers.
How to report
Email [email protected] with a description of the issue, steps to reproduce, the affected URL or app version, and your contact details. Please do not include real user data. Our security.txt has the same contact.
Scope
- https://digitalmunshi.com.pk and its subdomains, including https://app.digitalmunshi.com.pk (opens in a new tab)
- The Munshi Android app (pk.com.digitalmunshi.app) and, when released, the iPhone app
- Our form-processing endpoints
Out of scope: denial-of-service attacks, social engineering of our staff or users, physical attacks, spam, and issues in third-party services we do not control (report those to the vendor).
Rules
- Only test against accounts you own; never access, modify or delete other users’ data.
- Stop testing and tell us immediately if you encounter personal data.
- Give us reasonable time to fix the issue before any public disclosure.
Our commitment
- We acknowledge reports within 3 working days and keep you updated.
- We will not take legal action against good-faith research that follows this policy.
- With your permission, we will credit you once the issue is fixed.
We do not currently run a paid bug-bounty programme.