Security Policy

Report a vulnerability: security@lalacar.in (PGP on request)

Scope

In scope: lalacar.in and its subdomains, the LalaCar Android and iOS apps, our Firebase Cloud Functions API (asia-south1), our Firestore and Storage security rules, and the admin console.

Out of scope: third-party services we consume (Google, Firebase, Razorpay, Swiggy), volumetric denial of service, social engineering, physical attacks, rate-limit findings with no demonstrated impact, and automated scanner output with no working exploit.

Rules

Test only against accounts and data you own. Do not access, modify or exfiltrate other users' data, do not degrade the service for anyone else, and do not disclose the issue publicly until we have fixed it or 90 days have passed, whichever comes first.

Safe harbour

Research carried out in good faith and within the rules above is authorised. We will not pursue legal action against you or report you to law enforcement, and we will say so in writing if a third party asks.

Response times

Matching our published grievance SLA: acknowledgement within 24 hours, triage and a severity within 5 working days, and a fix or a dated remediation plan within 15 days. Critical issues are patched out of band. We credit reporters by name unless you would rather we did not. We do not currently run a paid bounty.

Other contacts

• Privacy: dpo@lalacar.in
• Grievance Officer (IT Rules 2021): grievance@lalacar.in
• Support · Privacy Policy · Terms of Service

Entity: Rudraayaan AI Technologies Private Limited, Hyderabad, India.