Two things live here: how this website is built, and how Plaw handles customer data. Found a vulnerability? Email team@plaw.io. We reply to every report within three business days.
This website
plaw.io is a static site served by Cloudflare over HTTPS. There are no accounts, no login, and no payments. The only script is the booking embed on /meet, and it loads only when you open the calendar. The site itself stores nothing you type; the booking embed on /meet sends your details to us and Cal.com, as the privacy page describes. That keeps the attack surface small on purpose.
Reporting a vulnerability
We publish a security.txt. Send reports to team@plaw.io. We tell you what we plan to do about the finding. There is no bug bounty. Real findings get fixed promptly, and credited if you want credit.
Customer data
The website is the small part. Our work runs inside customer systems, and that touches their records and data. Each customer’s agreement states what we access, what we store, and for how long. Veto checks every agent action against the customer’s written policy before it runs. The policy decides what runs on its own; anything it marks for sign-off, such as a payment over a set amount, waits for a person.