Vulnerability Disclosure Policy

This Vulnerability Disclosure Policy applied from April 20, 2026 to September 17, 2026 (JST).

View the current Vulnerability Disclosure Policy

ALAKI Inc. (“we”, “our”, or “us”) accepts vulnerability reports to improve the security of MONJI, MONJI+, and all related websites, applications, APIs, and information systems operated by us.

We respect responsible disclosure made in good faith and will review and respond to reports submitted in accordance with this policy within a reasonable scope.

1. Reporting Channel

Please report vulnerabilities through the following dedicated contact:

Vulnerability Report Form

To avoid delays, please do not use other channels (such as contact forms, sales channels, social media, or third parties).

2. Scope

This policy applies to assets operated and managed by us, including:

Websites under the monji.tech domain
MONJI
MONJI+
Production web applications, APIs, and admin panels provided by us

The following may be considered out of scope:

Third-party services not controlled by us
Services managed independently by external vendors
Test, development, or non-public environments
Any assets we reasonably determine to be out of scope

3. Required Information

When submitting a report, please provide as much of the following information as possible:

Affected URL, screen, feature, or API endpoint
Description of the vulnerability
Steps to reproduce
Potential impact
Non-destructive proof of concept (PoC) or references
Date and time of discovery
Contact information
Whether any data belonging to us, users, or third parties was accessed, and if so, details of such access

Incomplete reports may delay investigation and response.

4. Allowed Testing

Testing is permitted only under the following conditions:

Use only accounts you own or control
Do not impact other users or third parties
Limit testing to the minimum necessary to confirm the vulnerability
If you access personal or sensitive data, stop immediately and report it

5. Confidentiality and Disclosure

We follow a coordinated disclosure approach.

Do not disclose or share any vulnerability details with third parties until we have provided a fix or mitigation, or until a mutually agreed disclosure date.

We may request additional information or assistance as needed.

6. Prohibited Activities

The following activities are strictly prohibited:

Accessing, retrieving, modifying, deleting, retaining, or disclosing data belonging to us, users, or third parties
Attempting privilege escalation
Bypassing authentication, session hijacking, or account takeover
Causing service disruption, degradation, or excessive load
Destructive scanning or excessive automated access
Social engineering, phishing, impersonation, or physical attacks
Uploading, distributing, or executing malware
Spam, abuse of forms, or mass submissions
Violating laws, contracts, or third-party rights
Disclosing vulnerability information without prior written approval or agreed disclosure timing
Any other activity we deem inappropriate

All testing must be non-destructive and limited to the minimum required.

7. Our Response

We aim to:

Acknowledge receipt within 7 business days
Review and triage the report
Request additional information if needed
Take appropriate remediation or mitigation actions
Notify you upon completion when appropriate

Response times may vary depending on complexity and volume.

8. No Reward

We do not provide any rewards, compensation, reimbursements, or any form of monetary payment for vulnerability reports.

By submitting a report, you agree that:

Your report is provided voluntarily and without expectation of compensation
You will not claim or request any fees, damages, or compensation
We are not liable for any costs, losses, or damages related to your report
You will not request payment unless explicitly agreed in writing in advance

9. Disclaimer and Rights

This policy does not grant permission for unrestricted testing, access, intrusion, data extraction, or load testing.

We reserve the right to take appropriate action against violations of this policy, illegal activities, or actions that may cause harm to us or third parties.

We do not grant any authorization or protection regarding third-party systems or services.

10. Acknowledgment

We appreciate responsible disclosure made in good faith. With your consent, we may acknowledge your contribution.

11. Changes

We may update this policy at any time without prior notice. The latest version will be published on this page.

12. Safe Harbor

If you act in good faith, follow this policy, and stay within the defined scope, we will not pursue legal action against you.

However, this does not apply to violations of this policy, malicious activities, or actions that impact third-party data or systems.

Version History

Version 1.0 — April 20, 2026 (JST), Established and effective
Version 2.0 — September 18, 2026 (JST), Revised and effective