Security Disclosure Policy

You can also read this document in Japanese here

At LaLoka Labs, we consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present. If you’ve discovered a vulnerability, please follow the guidelines below to report it to our security team:

• E-mail your findings to security@lalokalabs.co

This policy only applies to the services listed below:

• The LaLoka Labs corporate website
• OTP Verification API – GetOTP
• AI Writer and AI Content Generator – Kafkai

Please follow these rules when testing/reporting vulnerabilities:

• Do not take advantage of the vulnerability you have discovered, for example by downloading more data than is necessary to demonstrate the vulnerability.
• Do not read, modify or delete data that isn’t your own.
• We ask that you do not disclose the issues to third parties until it has been resolved.
• The scope of this policy is limited to technical vulnerabilities in our services. Please do not try to test physical security or attempt phishing attacks against our employees, and so on.
• Out of concern for the availability of our services to all users, please do not attempt to carry out DoS attacks, leverage black hat SEO techniques, spam people, and do other similarly questionable things. We also discourage the use of any vulnerability testing tools that automatically generate significant volumes of traffic.
• Avoid leaving persistent payloads, XSS or the like behind you. Instead, use non-harmful payloads, track what you do, limit who is exposed as much as possible, and clean up!
• Please refrain from requesting compensation for reporting vulnerabilities. If you want we can publicly acknowledge your responsible disclosure.

The following security issues are currently not in scope, so we ask that you do not report them:-

• Volumetric/Denial of Service vulnerabilities (i.e. simply overwhelming our service with a high volume of requests);
• TLS configuration weaknesses (e.g. “weak” cipher suite support, TLS1.0 support, sweet32 etc.);
• Reportsindicating that our services do not fully align with “best practice” (e.g. missing security headers or suboptimal email-related configurations such as SPF, DMARC etc.);
• Issues surrounding the verification of email addresses used to create user accounts;
• Clickjacking vulnerabilities;
• Self XSS (i.e. where a user would need to be tricked into pasting code into their web browser);
• CSRF where the resulting impact is minimal;
• CRLF attacks where the resulting impact is minimal;
• Host header injection where the resulting impact is minimal;
• Network data enumeration techniques (e.g. banner grabbing, existence of publicly available server diagnostic pages);
• Reports of improper session management / session fixation vulnerabilities.

What we promise:

• If we deem your report as valid, significant and reproducible, we will respond to your report with our evaluation of the report.
• If you have followed the instructions above, we will not take any legal action against you in regard to the report.
• If we have decided to respond to your report, we will also keep you informed of an expected resolution date.
• If we have decided to respond to your report, to show our appreciation for your effort and cooperation during the report, we will list your name and a link to a personal website/social network profile on the page below so that the public can know you’ve helped keep our services secure for the benefit of many.

We sincerely appreciate the efforts of security researchers in keeping our services safe.

Created on 2021-10-28
Last Updated 2025-11-06

List of Contributors

Nikita Patel – LinkedIn
Karan Rathod – LinkedIn
Satyam Singh – LinkedIn
Bulwarkers Websecruity Pvt. Ltd. – Website