Vulnerability Disclosure Program

Law firms trust ModulawAI with privileged material, so we welcome help from the security community in finding weaknesses before anyone else does. If you believe you have found a security vulnerability in ModulawAI, please tell us. This page sets out how to report it, the rules for testing, how we protect researchers who follow them, and what to expect from us.

By submitting a report, you confirm that you have read and accept the terms on this page.

1. How to report

Email security@modulaw.ai with the subject “Vulnerability report”. So that we can act on it quickly, please include:

• a clear write-up, in the email or as an attached PDF: what the issue is and where (URL, endpoint or feature);
• step-by-step instructions to reproduce it, with any proof-of-concept, screenshots or request and response samples;
• a severity score using CVSS (version 3.1 or 4.0), with the vector string, and your view of the real-world impact;
• the test account or workspace you used, and how you would like to be credited, if at all.

Reports without reproduction steps, or that only paste the output of an automated tool, may be closed without a response. One issue per report helps us track each fix.

2. Scope

• *.modulaw.ai, including the web application (app.modulaw.ai) and its APIs (backend.modulaw.ai, auth.modulaw.ai).
• The ModulawAI for Word add-in and the ModulawAI desktop app.
• The client portal, shared document links, signing links and the Trust Center document portal.
• This website (modulaw.ai), for issues that affect our users or their data.

3. Vulnerabilities we want to hear about

Including, but not limited to:

• Cross-tenant access: anything that lets one firm, user or client see or change another’s matters, documents, messages or settings.
• Broken access control and insecure direct object references, including through shared links and the client portal.
• Authentication, session and multi-factor authentication bypass.
• Injection: NoSQL and SQL injection, cross-site scripting, template injection, OS command injection, XML external entities.
• Remote code execution, server-side request forgery, and path traversal.
• Sensitive data exposure, including exposed credentials, tokens or keys with a demonstrated impact.
• AI-specific: prompt injection, for example through an uploaded document or email, that makes the assistant disclose data the user should not see or take an action the user did not approve.
• Security misconfigurations with a demonstrated impact, and components with known vulnerabilities that you show are exploitable here.

4. Out of scope

• Denial of service, load or stress testing, email bombing, and volumetric attacks.
• Social engineering, phishing or physical attacks on our staff, customers, offices or devices, and attacks needing physical access to an unlocked device.
• Services we do not run (for example payment, email, cloud and AI providers). Report those to the provider.
• Output of automated scanners without validation and a demonstrated impact.
• Issues without a clear security impact: missing security headers or cookie flags, descriptive error messages, clickjacking on pages without sensitive actions, HTTPS mixed content, SSL or TLS cipher and forward-secrecy settings, and SPF, DKIM or DMARC records.
• Self-XSS that cannot be used against other users, and cross-site request forgery on forms available to anonymous users.
• Missing CAPTCHA, absent or bypassable rate limits, password complexity and account recovery policies, and username or email enumeration, unless you show they lead to account takeover or access to data.
• Vulnerabilities that need an unlikely amount of user interaction, or that affect only outdated or unsupported browsers and platforms.
• Use of a library with a known vulnerability without evidence that it is exploitable here, and zero-day issues in third-party software reported within 30 days of a public patch.
• Exposed login pages, public API documentation, and verbose files or directory listings that reveal nothing sensitive.

5. Rules

• Test only with accounts and workspaces you create yourself. Never use another person’s account or credentials.
• Do not access, change, download or delete data that is not yours. If you reach other users’ data by accident, stop, do not keep or share it, and tell us straight away.
• Do the minimum needed to show the issue: no persistence, no pivoting to other systems, no degrading the service for others.
• Limit automated scanning to 5 requests per second.
• Do not send spam or unsolicited messages through ModulawAI, and do not upload or store malicious software on our systems.
• Once you have sent your report, delete any data you obtained during testing.
• Keep the details, and any confidential information you came across, confidential until we have fixed the issue or 90 days have passed since your report, whichever is sooner, and agree the disclosure with us.
• Do not demand payment or make threats in exchange for a report.

6. Safe harbour

If you research and report in good faith and follow these rules, we will consider your research authorised, we will not take legal action against you or ask law enforcement to investigate you for it, and if a third party takes action against you over research that followed these rules, we will make it known that your work was authorised by this program. If you are unsure whether something is allowed, ask us first at security@modulaw.ai.

7. What happens next

• We acknowledge your report within 2 business days.
• We confirm whether it is valid, and how severe, within 5 business days.
• We aim to fix critical issues within 7 days, high within 30 days and medium within 90 days, and we keep you updated until it is fixed.
• If customer data was affected, we follow our incident response plan, including notifying affected customers as our Data Processing Agreement requires.
• If several people report the same issue, we credit the first complete report.

8. Recognition

We do not offer monetary or other rewards at this time. We are a young company, and we would rather say so plainly than promise what we cannot pay. With your permission, we thank researchers who report valid issues by name on this page and with a letter of appreciation. We plan to introduce rewards as we grow, and reports made under this program will count when we do.

Thank you

No reports yet. You could be the first.

9. Legal

• You confirm that the report is your own work, and you allow ModulawAI to use it to investigate and fix the issue and to describe it in our own security records and advisories.
• Taking part does not make you our employee, contractor or partner. Please do not present your report as an endorsement, partnership or certification, or use our name, logo or trademarks in marketing, without our written consent. Factual, agreed public write-ups after the fix are welcome.
• You must comply with the law where you are. This program cannot authorise testing of systems we do not own.
• We may update these terms. The version on this page when you submit your report applies to it.

Thank you for helping keep ModulawAI and the firms that rely on it safe.