Legal
Security and Responsible Disclosure
Last updated: 26 October 2026
Report a vulnerability
Email security@llmgraph.in.
Please include what you found, the steps to reproduce it, the version of the program (llmgraph/<version>) and your operating system. Do not include other people's personal data. We acknowledge your report within 3 working days and keep you informed as we investigate and fix it. Privacy and data requests go to dpo@llmgraph.in, not to this address.
In scope
- The program (the
llmgraph-mcplauncher and the engine) and the licence service. - The site at https://beta.llmgraph.in, including sign-in, device approval, the billing link and account deletion.
Out of scope
- Systems run by Dodo Payments, Google, Cloudflare and Resend. Report those to the provider.
- Social engineering, physical attacks and denial-of-service testing.
- Reports from automated scanners that show no real impact.
Rules for good-faith research
- Test only with accounts you own. Do not access, change or delete other people's data.
- Do not degrade the service, and do not run load tests.
- Give us a reasonable time to fix a problem before you publish it.
- Do not use a vulnerability beyond what is needed to show it exists.
What we promise
If you follow these rules, we will not take legal action against you for your research, and we will work with you to understand and fix the problem. We credit reporters who ask to be named. We do not run a bounty.
security.txt
Our machine-readable contact file is at https://beta.llmgraph.in/.well-known/security.txt.
See also the Privacy Policy and the Terms of Service.