Security policy.
Last updated: April 11, 2026
Introduction
Philaw Library takes the security of our users and their devices seriously. We welcome reports from security researchers and members of the public who discover vulnerabilities in our website (philaw.org) or any of our Android apps, and we commit to investigating every good-faith report.
This policy explains how to report a vulnerability, what to expect after you report, and the boundaries within which we ask researchers to operate.
How to Report
Please email your report to support@philaw.org with a subject line starting with [Security]. If you believe the issue is sensitive, feel free to mark it clearly in the subject so we can prioritize it.
We also publish a machine-readable contact at /.well-known/security.txt following RFC 9116.
What to Include
To help us triage and fix issues quickly, a good report usually contains:
- A clear description of the vulnerability and its impact
- Steps to reproduce, ideally with proof-of-concept code, requests, or screenshots
- The affected asset (URL, app package name, app version, or endpoint)
- Any relevant environment details (browser, OS, device, network)
- Your name or handle if you would like to be credited, or a note that you prefer to remain anonymous
Scope
In Scope
- The philaw.org website and its subdomains
- Android apps published by PhiLaw Education Apps under the
org.phillaw.*package namespace on Google Play
Out of Scope
- Third-party services we integrate with (Google AdMob, Firebase, Google Play) — please report those issues to the respective vendor
- Denial-of-service, volumetric, or stress-testing attacks
- Social engineering of our staff, partners, or users
- Physical attacks against infrastructure or people
- Spam, automated scanner output without a concrete impact, or missing best-practice headers with no demonstrated exploit
- Vulnerabilities that require a rooted, jailbroken, or otherwise compromised device to exploit
Our Commitment
When you report a vulnerability in good faith, we will:
- Acknowledge receipt of your report, typically within a few business days
- Investigate and keep you informed about our progress toward a fix
- Work to remediate confirmed issues as quickly as the severity warrants
- Credit you publicly on this page if you wish, once the issue is fixed
Safe Harbor
We consider security research and vulnerability disclosure conducted consistent with this policy to be authorized conduct. We will not pursue civil or criminal action against researchers who:
- Make a good-faith effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data
- Only interact with accounts they own or with explicit permission from the account holder
- Give us a reasonable amount of time to investigate and fix an issue before publicly disclosing it
- Do not exploit a vulnerability beyond the minimum necessary to demonstrate it
If legal action is initiated by a third party against you for activities conducted in good faith under this policy, we will make it known that your actions were authorized.
Contact
For all security-related matters, please reach out at: