Reporting a security problem

How to report

Email [email protected] with "Security" at the start of the subject line. Tell us what you found, the address or endpoint where you found it, the steps to reproduce it, and what an attacker could do with it.

We reply within 3 working days to confirm we have the report and to tell you who is handling it.

What we ask of you

Test only against your own account and your own data. Do not read, change or delete anyone else's research, and stop as soon as you have enough to show the problem.

No denial of service, no load or stress testing, no spam, no social engineering of our staff or our customers, and no physical testing.

Give us a reasonable chance to fix the problem before you publish anything about it.

What we do

We acknowledge your report within 3 working days and keep you informed while we work on it.

For a critical vulnerability we put a temporary fix in place within 3 calendar days of confirming it, and a definitive fix within 10 calendar days.

We credit you by name when the fix ships, if that is what you want. We do not run a paid bug bounty programme.

In scope

bioskepsis.ai, app.bioskepsis.ai, the BioSkepsis API served from app.bioskepsis.ai, the BioSkepsis connector for Claude, and the BioSkepsis add-on for eLabNext.

Out of scope

Services we buy rather than build, such as sign-in, payments, email delivery, error reporting, the content delivery network, hosting and the AI model providers. Report those to the provider, and tell us so we can follow up.

Scanner output with no working proof, missing hardening headers with no demonstrated impact, rate-limit observations with no consequence, and anything that needs physical access to somebody's unlocked device.

Safe harbour

If you follow this policy, we treat your testing as authorised, we will not pursue legal action over it, and we will say so if a third party asks us.