Security policy

Version 0.1, effective 22 Oct 2026.

Reporting a vulnerability

Email paul@anaphasescience.com with the subject "Security report", and include:

• what you found and where (URL, version, file or endpoint)
• steps to reproduce, and what an attacker could do with it
• whether you have shared it with anyone else

Please do not include real research data, patient information or other people's personal information. A synthetic example is enough.

We will acknowledge your report within 5 working days, keep you updated, and tell you when it is fixed. We will credit you in the release notes if you want to be credited.

Scope

In scope: this website, BioPlot (plotvera.app), SideScatter (gatecraft.bio), BioSmith (biosmith.app) and BioGlyph, including their API routes and MCP connectors.

Out of scope: denial-of-service and volume testing, social engineering, physical attacks, findings in third-party services that we do not control (report those to the provider), and reports from automated scanners without a demonstrated impact.

Safe harbour

If you act in good faith, stay within this scope, do not access or change other users' data beyond what is needed to show the problem, and give us reasonable time to fix it before disclosure, we will not pursue or support legal action against you for your research.

What we do

• Hosted AI and billing paths are off unless their server keys are deliberately set, and are rate limited in code.
• Secrets are held only in the hosting provider's environment settings, never in a repository.
• Dependencies are checked for known high-severity advisories before each release.

This is a research beta run by a small team. We do not claim any certification.

Machine-readable contact: https://anaphasescience.com/.well-known/security.txt