Contact: mailto:security@baxtra.pages.dev
Contact: https://baxtra.pages.dev/security
Expires: 2027-08-31T00:00:00.000Z
Preferred-Languages: en
Canonical: https://baxtra.pages.dev/.well-known/security.txt
Policy: https://baxtra.pages.dev/security

# Baxtra Research Labs vulnerability disclosure.
#
# In scope:      baxtra.pages.dev and everything served from it.
# Out of scope:  the three portals' client-side authentication. It is a
#                front-end demonstration with no application server behind it,
#                every check runs in your browser, and it is documented as not
#                being a security boundary at /security. Reports that it can be
#                bypassed by editing the page are already known and accepted.
#                No real patient, clinical or commercial data exists behind it.
#
# We would very much like to hear about: anything that affects a visitor who
# has not tampered with their own browser, header or policy misconfiguration,
# content that should have been withheld under the disclosure policy but was
# not, and anything that misrepresents the regulatory status of an
# investigational product.
#
# Please do not run automated scanning that degrades the service for others.
# We do not operate a paid bounty. We will acknowledge within five working
# days and we will credit you if you want to be credited.