Report a vulnerability
Email security-sensitive reports to security@anduine.com. Include the affected URL or component, reproduction steps, impact and any proof of concept that does not expose another person’s health information.
Protecting a patient-controlled health service.
Anduine uses layered access control, encryption, privacy redaction, automated security scanning and data-minimisation safeguards. Security is a continuing process, so we also welcome responsible reports.
Safe-harbour expectations
Use only accounts and data you control, avoid privacy violations or service disruption, do not persist access after demonstrating the issue, and give us a reasonable opportunity to remediate before public disclosure.
Release security
Production changes are built and tested in CI, dependencies are audited, and the JavaScript/TypeScript tree is scanned with CodeQL. Health and smoke checks verify critical production configuration after release.
Sensitive information
Do not put patient data, secrets, access tokens, passwords or private keys into a public issue. If a report contains sensitive material, use the security email above.
Security does not replace medical judgement
Anduine is a patient-side memory and organisation service, not an emergency service, diagnostic system or prescribing tool.