Talaqqi Lillah security disclosure policy

Talaqqi Lillah is a free, volunteer-run Quran tutoring academy. Many of our students are children, so we take the security of their accounts and data seriously. If you find a security problem in our apps, our website or our servers, please tell us privately so we can fix it before anyone is harmed.

How to report

• Email: security@talaqqilillah.org (the Contact in security.txt).
• Please include what you found, where (the app and version, or the address), the steps to reproduce it, and what an attacker could do with it.
• Write in English if you can. Screenshots or a short video help.
• Please don't put personal data you came across in the report. Describe it instead ("the reply contained another user's phone number").

What we promise

• We acknowledge every report within 72 hours.
• We keep you updated while we work on it, and tell you when it's fixed.
• We won't take legal action against you, or ask anyone else to, for research that follows this policy.
• With your permission, we thank you by name once the problem is fixed. We are a free, volunteer-run academy, so we don't pay rewards.

What we ask of you

• Test only with accounts you created yourself. Never access, change or delete other people's data. If you reach someone else's data by accident, stop, don't keep a copy, and tell us.
• Don't contact our students, tutors or volunteers, and don't try to trick them (no phishing or social engineering).
• Don't disrupt the service: no denial-of-service tests, load tests, spam, or automated scanning that sends large numbers of requests.
• Don't test physical security, and don't attack our hosting, email or other providers' systems.
• Give us a reasonable time to fix the problem before you tell anyone else about it. We aim to fix serious problems within 30 days and will agree a date with you.

In scope

• The Talaqqi Lillah Android and iOS apps from the official stores.
• api.talaqqilillah.org, files.talaqqilillah.org and the website at talaqqilillah.org.
• The Admin Panel at admin.talaqqilillah.org sits behind an access gateway. Report weaknesses you can find from outside it; don't try to sign in.

Out of scope

• Reports from automated scanners without a demonstrated problem.
• Missing security headers or settings that have no real security impact.
• Attacks that need a rooted or jailbroken phone you control, or physical access to an unlocked device.
• Rate limits that can only be reached with a very large number of requests.
• Problems in third-party services we use (report those to the provider).

Legal

This policy is written in good faith. It doesn't give anyone permission to break the law or to act against the rights of our users. TODO(spec): the academy's legal name and a lawyer's review, as for the other legal documents in docs/legal/.

Version 1 · 2026-10-16