Vulnerability disclosure policy

AUSCLIN PTY LTD (ABN 22 687 945 080), which operates AI Dietitians, welcomes the responsible disclosure of security vulnerabilities. This policy explains how to report a vulnerability, what you can expect from us, and the conditions under which we will not take action against you for your research.

How to report

Email privacy@aidietitians.com.au with the subject line "Security report", or use our contact page. Please include:

• a description of the vulnerability and its potential impact;
• the affected product, address or endpoint;
• clear steps to reproduce it;
• any supporting material, such as screenshots or a proof of concept.

Never include real patient information, other people's personal information, passwords or access tokens in your report. Our machine-readable contact details are at /.well-known/security.txt.

What to expect from us

• We aim to acknowledge your report and complete an initial triage within 5 business days.
• We will keep you informed of our progress and tell you when the issue is fixed.
• We aim to fix confirmed vulnerabilities within 90 days of confirming receipt. We may agree a longer period with you for complex issues.
• If you have not heard from us within 5 business days, you may give us a further 5 business days' written notice before disclosing.

Scope

In scope:

• aidietitians.com.au (this website)
• app.aidietitians.com.au (the application)
• api.aidietitians.com.au (the application programming interface)

We are particularly interested in:

• authentication and authorisation flaws, including access to another practice's or another user's data;
• server-side injection (for example SQL injection, command injection or server-side request forgery);
• cross-site scripting or request forgery with a demonstrable impact;
• prompt injection or manipulation of the AI features that leads to data exposure or unsafe output;
• weaknesses in encryption or in how data is transmitted.

Out of scope:

• denial-of-service testing or anything that degrades the service;
• social engineering, phishing or physical attacks;
• vulnerabilities in third-party services we use, unless they arise from how we configure them;
• missing security headers, or best-practice findings without a demonstrable exploit;
• self-XSS or issues that need unlikely user interaction;
• confirming that an email address has an account, without access to any data;
• outdated browsers or end-of-life software.

Rules for researchers

You may:

• test using an account you created yourself, on the live service;
• inspect requests and responses, and test input handling and access controls, within your own account.

You must not:

• access, download, change or keep data that is not yours, beyond the minimum needed to confirm a vulnerability; if you reach someone else's data, stop and tell us;
• use real patient information at any time;
• run automated scanners or high volumes of automated requests without our written approval;
• attempt to guess or brute-force passwords or codes;
• disrupt the service or exhaust its resources;
• share details of the vulnerability with anyone else before it is fixed;
• continue testing after we ask you to stop.

Safe harbour

AUSCLIN PTY LTD will not pursue civil or criminal action, and will not refer the matter to law enforcement, against any person who:

• reports a vulnerability to us in good faith;
• follows this policy, including the rules above;
• accesses only the data needed to confirm the vulnerability, and does not keep it;
• does not disrupt the service;
• does not disclose the vulnerability before we have fixed it or the timeframes above have passed; and
• acts lawfully in every other respect.

This commitment does not cover conduct outside this policy, criminal offences, demands for payment as a condition of disclosure, sharing details with third parties before a fix, or continuing to test after we have asked you to stop.

Rewards

We do not run a paid bug bounty programme. With your permission, we are happy to thank you publicly once an issue you reported is fixed.

Governing law

This policy is governed by the laws of New South Wales, Australia. We may update it at any time; the date at the top shows the latest version.