ANIML Health Inc. welcomes reports of security problems in ARC (Animal Research Companion) from customers, researchers and anyone else. This page says how to report one, what we ask of you, and what you can expect from us. The same details are in machine-readable form at /.well-known/security.txt.
How to report
Write to we.care@animl.health with "Security" in the subject. Include:
- what you found and where (the address, the screen or the API endpoint);
- the steps to reproduce it, and what an attacker could do with it;
- your name or handle, if you would like to be credited.
Write in English or French. If the report holds sensitive detail, say so in a first message and we will agree a safer way to send it.
What is in scope
- The ARC application at app.arcvet.io and its API (
/api/v1). - The demonstration and sandbox server at demo.arcvet.io.
- The public website at arcvet.io.
- ARC's source code and the release images ANIML publishes.
Installations that a customer runs on its own servers belong to that customer: report problems in their configuration to them, and problems in ARC's code to us.
What we ask of you
- Test only with accounts and data that are yours. Use the sandbox (ask for one through Talk to us) rather than production where you can. Never read, change or delete other customers' records; if you reach any by accident, stop, keep nothing, and tell us.
- Do no harm. No denial of service, no load testing, no spam, no social engineering of our staff or customers, no physical attacks.
- Give us time. Keep the problem confidential until we have fixed it, or for 90 days from your report, whichever comes first, unless we agree otherwise.
What you can expect from us
- An acknowledgement within 3 business days.
- Our assessment, and a planned fix date for a confirmed problem, within 10 business days.
- Fixes on our usual targets: critical problems within 7 days, high within 30, medium within 90.
- Word when it is fixed, and credit if you would like it.
- No legal action against research done in good faith under this page.
We do not run a paid bug bounty at this time.
Telling customers
If a problem has put customer data at risk, we follow our incident response process, which includes telling the customers concerned and, where the law requires it, the privacy authorities.