Security & Responsible Disclosure
AutismDock stores sensitive information about children and families. We take security seriously and welcome the security research community's help in improving it.
How we protect data
- •TLS 1.3 encryption in transit and encryption at rest in the database.
- •Row-Level Security (RLS): each user can only read their own data.
- •Role-based access control (family, professional, educator, administrator).
- •Single-use invitations for professionals accessing a child's data.
- •Granular per-professional permissions (clinical, agenda, reports) and granular consent for the data used by AI.
- •Access logging: families can see which professionals viewed their children's data.
- •Private image storage with short-lived signed URLs.
- •Bcrypt-hashed passwords and email verification.
Found a vulnerability?
Email us at support@lumendralabs.com with the subject "Security". Every report is reviewed personally.
- •A description of the issue and its potential impact.
- •Steps to reproduce it (URLs, screenshots, sample requests).
- •Your contact email if you'd like a response or acknowledgment.
Program scope
In scope
- •autismdock.com, www.autismdock.com and the AutismDock web/Android app.
- •Access-control flaws: reading or modifying another user's data, bypassing RLS or granular permissions.
- •Authentication and sessions: session hijacking, login bypass, role escalation.
- •Injection (SQL, stored XSS, SSRF) and exposure of personal or children's data.
Out of scope
- •Denial-of-service attacks (DoS/DDoS) or spam.
- •Social engineering against employees or users.
- •Vulnerabilities in third-party services outside our control.
- •Issues requiring physical access to the victim's device, or clickjacking without demonstrable impact.
- •Automated tooling that degrades the service for other users.
Bug bounty (rewards)
We pay rewards for valid vulnerabilities reported responsibly and within scope. The final amount depends on impact and report quality.
Critical€200 – €500Access to other families' data, RLS or authentication bypass
High€100 – €200Privilege escalation, SQL injection, stored XSS with session theft
Medium€50 – €100IDOR without sensitive data, reflected XSS, limited information leaks
LowHall of FameMinor issues and hardening suggestions: public recognition
Rewards are paid by bank transfer or PayPal once the issue is verified and fixed. The same vulnerability is rewarded once (first valid report).
What we ask
- •Do not access, modify, or delete other users' data.
- •Do not perform denial-of-service attacks or spam.
- •Give us a reasonable timeframe to fix issues before public disclosure.
- •Act in good faith: we will not take legal action against responsible research within these rules (safe harbor).
What you can expect
- •Acknowledgment of receipt within 72 business hours.
- •Assessment and severity triage within 7 days.
- •An honest assessment and updates on the fix status.
- •Reward payment and public acknowledgment (if you wish) once the vulnerability is resolved.
Transparency & continuous review
- •We run automated security scans over the database and code on every relevant change.
- •We internally review access permissions and policies on a regular basis.
- •We will publish a summary on this page when we complete independent external audits.
Hall of Fame
No researchers recognized yet. Will you be the first? Report a valid vulnerability and you'll appear here (only with your permission).