Vulnerability Disclosure

Daobook holds clinical records for many practices. If you find a way in that should not be there, we want to hear about it before anyone else does, and we want you to be safe telling us. This page is the agreement: what you may test, how to report it, and what we will do.

How to report

Email security@daobook.health. Tell us the page or request involved, the steps to reproduce it, and what an attacker could do with it. A short proof is enough; a video or a request log helps. If you would like to be credited, say the name to use.

Our machine-readable contact file is at /.well-known/security.txt on both of our domains.

What is in scope

www.daobook.com.au and daobook.health: the practitioner application, sign-in and account recovery, the online booking and intake-form pages a clinic shares with its clients, and the public site.
api.daobook.com.au and api.daobook.health: the Daobook API and the assistant (MCP) connection, as described in the API Terms of Use.
Email and text messages Daobook itself sends, where the weakness is in what Daobook sends or how it handles a reply.

Anything that would let one practice see, change or delete another practice's records, or let anyone reach a clinical record without signing in, is the kind of report we most want.

What is out of scope

The services Daobook connects to (payment processors, accounting, email and SMS providers, the dispensary's store, our cloud provider). Report those to the vendor.
Denial of service, flooding, or anything that degrades the service for the clinics using it.
Social engineering or phishing of Daobook staff, of a clinic, or of a clinic's clients. Physical attacks.
Reports from automated scanners with no demonstrated impact; missing security headers, cookie flags or email authentication records on their own; version banners; clickjacking on a page with no sensitive action; self-XSS; rate limits on public forms unless you can show the limit is bypassed.
Weaknesses that need a compromised device, a stolen password or a browser extension to begin with.

Rules for testing

Daobook is a live system holding real patients' health information, so the rules are stricter than for most web applications:

Test only on your own trial account. Anyone can start a free trial; make as many as you need. Never test against an account, a clinic or a client record that is not yours.
Stop at the first evidence. If a weakness exposes another account's data, confirm that it does and report it. Do not read further, download, change or delete anything, and do not keep any data you saw. Tell us in the report if you saw any.
No automated scanning at volume. Keep tools to a few requests a second. Our rate limiter blocks addresses that probe quickly, which wastes your time as much as ours.
Do not send messages to real people. Booking pages, intake forms, reminders and the API can send email and text messages; make sure every address and number is yours.
Keep it private until it is fixed. We ask for 90 days from your report, or until we tell you it is fixed, whichever is sooner, before anything is published. If we need longer we will say so and explain why.

What we promise

We will acknowledge your report within five business days and tell you whether we can reproduce it.
We will keep you informed, at least every two weeks while the fix is open, and tell you when it ships.
We aim to fix anything that exposes patient data within days, and everything else within 90 days.
We will credit you by name on this page when the fix is live, if you would like us to.
We do not currently pay a bounty. Daobook is a small company and we would rather be honest about that than promise what we cannot keep.

Safe harbour

We consider security research done in good faith, within the scope and rules above, to be authorised. We will not initiate legal action against you for it, and we will not report it as a breach of our terms. If a third party brings an action against you for research that followed this policy, we will make it known that your actions were authorised. This does not extend to testing another practice's account or data, which is never authorised.

Acknowledgments

Nobody is listed yet. Reports that lead to a fix, and whose authors would like to be named, will be credited here.

Data Security: how the platform is built to keep records safe.
API Terms of Use: the terms of the Daobook API.