Security & vulnerability disclosure
We build governance software for organisations that take security seriously, and we hold ourselves to that bar. If you've found a vulnerability, we want to hear from you.
Our commitment
We welcome reports from security researchers and will work with you in good faith to verify and remediate genuine issues. We will not pursue legal action against researchers who follow this policy.
How to report
Email [email protected] and include the following.
- a clear description of the issue and its impact
- steps to reproduce (a proof-of-concept is appreciated)
- the affected URL, endpoint or component
- your contact details if you'd like acknowledgement
Scope
In scope are the Aicura application and APIs (app.aicura.app, backoffice.aicura.app and their origins), the marketing websites (aicura.app and aicura.com.au) and Aicura-operated infrastructure and configuration.
Out of scope are our sub-processors' own infrastructure (AWS, Auth0, Stripe, Cloudflare, Resend, Grafana), which should be reported to the provider, findings requiring physical access, social engineering of staff or denial-of-service, and automated-scanner output without a demonstrated, exploitable impact.
Rules of engagement
We ask that you do the following.
- give us reasonable time to remediate before public disclosure, and we target acknowledgement within a few business days and will keep you updated
- only interact with accounts you own or have explicit permission to test
- do not access, modify or exfiltrate other customers' data, so if you can demonstrate access, stop and report rather than extract
- avoid privacy violations, data destruction and service disruption, and don't run automated load or denial-of-service tests
What you can expect from us
- acknowledgement of your report
- a straight assessment of validity and severity
- updates as we remediate
- credit for the finding if you'd like it, once it's fixed
Safe harbour
We consider security research conducted in line with this policy to be authorised, will not initiate legal action for it and will work with you if a third party brings action against you for such research. If in doubt about whether something is in scope or permitted, ask first at [email protected].