Security
Security and responsible disclosure.
How to report a vulnerability, what is in scope, and what we will do next.
Reporting
Tell us privately. Give us time to fix it.
Security reports are handled as a priority. We will not ask you to demonstrate an issue against data you do not own.
Report a vulnerability
Write to the address below with the subject “Security disclosure”. Include a concise description, the affected URL or component, and the minimum information needed to reproduce the issue. Do not include patient data, personal data, credentials or confidential research data.
We will acknowledge receipt and agree next steps with you. We do not operate a paid bug bounty programme.
Scope
This policy covers the public ASR Lab and ASR Applied websites and their public endpoints. Third-party services, infrastructure providers and social engineering are out of scope.
Good-faith research should avoid accessing, changing or deleting data that does not belong to you; disrupting service; or testing accounts and systems you are not authorised to use.
Disclosure
Please give us a reasonable opportunity to investigate and fix the issue before public disclosure. We will coordinate with you on timing and credit if you would like to be acknowledged.
We will not pursue legal action for good-faith research that respects this policy. This page is a disclosure policy, not a warranty or a certification.
What we protect
Access to systems and scientific data is restricted to people who need it. Public forms explicitly warn against submitting identifiable patient information or confidential datasets. Sensitive engagement data is handled under an agreement rather than through the public website.