Vulnerability Disclosure Policy

1. Our commitment

BIQc welcomes reports from security researchers, customers and anyone else who finds a vulnerability in our platform. We will work with you to understand and fix it, and we will not take legal action against good-faith research that follows this policy.

2. How to report

Email security@biqc.ai with a subject line starting Security disclosure (reports titled [SECURITY] are also accepted). Please include:

• what you found and where (URL, API endpoint or feature);
• steps to reproduce, or a proof of concept;
• the impact you believe it has;
• how we can contact you, and whether you would like to be credited.

If your finding involves credentials, tokens or anyone else’s data, say so in the first line and do not include the sensitive detail. We will arrange a secure way to receive it.

Please do not report security issues through public channels, social media or GitHub issues.

3. Scope

In scope

• biqc.ai and www.biqc.ai
• app.biqc.ai
• api.biqc.ai
• dev.biqc.ai (our test environment)
• Sign-in, account, billing and team-management flows
• Integration and OAuth connection flows (Google, Microsoft and others)
• Data isolation between customer accounts

Out of scope

• Denial-of-service, load or volumetric testing
• Social engineering or phishing of BIQc staff, contractors or customers
• Physical attacks
• Vulnerabilities in third-party services we use (please report those to the vendor)
• Reports from automated scanners without a demonstrated impact
• Missing best-practice headers or settings without a demonstrated impact
• Our mobile app, which has not been released

4. Rules for testing

• Use only accounts you created yourself. Do not access, change or delete data that is not yours. If you reach someone else’s data, stop, do not keep a copy, and tell us.
• Do not degrade the service for other users. Keep automated requests to a low rate.
• Do not use a vulnerability beyond what is needed to demonstrate it.
• Do not publicly disclose the issue until we confirm it is fixed or 90 days have passed since your report, whichever comes first, unless we agree otherwise.
• Comply with all applicable laws.

5. What you can expect from us

• Acknowledgement: within 2 business days (Australian Eastern time).
• Triage and severity decision: within 5 business days.
• Fix or mitigation, Critical: within 7 days.
• Fix or mitigation, High: within 30 days.
• Fix, Medium or Low: within 90 days.

We will keep you informed, tell you when the issue is fixed, and credit you if you wish. BIQc does not currently run a paid bug bounty.

6. Safe harbour

If you act in good faith and follow this policy, we will consider your research authorised for the purposes of our Terms and Conditions, we will not pursue or support legal action against you, and if a third party takes action against you over research that followed this policy, we will make it known that your work was authorised.