Responsible Disclosure Policy

What we are looking for

This policy covers every service Burna AI operates:

• burna.ai, the Burna AI website.
• The Burna AI platform at app.burna.ai.
• ctcae.ai, the CTCAE lookup for research site teams.
• Protocol Studio, at protocolstudio.ai and app.protocolstudio.ai.
• The CTCAE by Burna AI mobile app for research site teams, and Healthnotes, the mobile app people taking part in a clinical study use.
• The APIs behind these services, at api.burna.ai and agent.burna.ai.

Care Journal, at carejournal.ai and app.carejournal.ai, is provided by the Counted Voice Foundation and has its own policy at carejournal.ai/responsible-disclosure.

Reports about:

• Authentication, session management, and authorization vulnerabilities, including sign-in codes, single sign-on, and the enrollment links a research site issues to study participants.
• Access across an account, organization, or study boundary.
• Injection flaws (SQL, NoSQL, command, LDAP).
• Cross-site scripting and cross-site request forgery.
• Insecure direct object references and server-side request forgery.
• Cryptographic weaknesses and insecure key handling.
• Sensitive data exposure, including protected health information.
• Server-side vulnerabilities (RCE, file upload, deserialization).
• Prompt injection or tool misuse in an AI assistant that exposes data, crosses an account or organization boundary, or takes an action the user did not ask for.
• Business logic flaws that could expose customer data or get around a permission or payment check.
• Vulnerabilities in third-party dependencies that materially affect Burna AI.

On the Burna AI platform and in the CTCAE by Burna AI and Healthnotes apps, the records that matter most belong to patients and study participants. Any way to reach them from outside the organization or study they belong to, or to guess or forge the enrollment link a site sends a participant, is the report we most want to receive.

What is out of scope

• Findings from automated scanners that do not include a working proof of concept.
• Best-practice recommendations without a specific vulnerability.
• Social engineering of Burna AI staff, customers, or partners.
• Denial of service attacks.
• Spam and content abuse on public forms.
• Physical attacks on Burna AI facilities or staff.
• Vulnerabilities requiring physical access to a victim's device.

How to report

Email [email protected] with the details below.

• A short description of the vulnerability.
• The affected product and the URL, endpoint, or system, with the app version for a mobile app.
• Reproduction steps with screenshots or video where helpful.
• The potential impact.
• Your name and any handle you would like credited (or "anonymous" if preferred).

To encrypt your report, email [email protected] first and request the current public key.

What we commit to

For every report made under this policy:

• Acknowledgement within 2 business days of receipt.
• Substantive response within 5 business days with our initial assessment.
• Remediation within 30 days for confirmed issues where feasible, and a stated timeline where a fix needs longer.
• Public credit to the reporter on resolution, with the reporter's preferred name or handle (or anonymized if requested).
• Safe harbor: we will not pursue legal action against researchers acting in good faith under this policy.

What we ask from you

In return, we ask that you:

• Make a good faith effort to avoid privacy violations, service disruption, and destruction of data during your research.
• Use only the minimum scope necessary to demonstrate the vulnerability.
• Do not access, modify, or delete data that belongs to anyone else; if you encounter protected health information or other sensitive data, stop and report immediately. Where showing an issue needs two accounts, create both yourself.
• Give Burna AI reasonable time to remediate before public disclosure.
• Do not perform testing that affects the integrity or availability of any Burna AI service.

Hall of Fame

Researchers who report confirmed vulnerabilities under this policy are credited on resolution. Credits include the researcher's preferred name or handle, the date of disclosure, and a brief summary of the issue category. Researchers may request anonymization or omission at any point before publication.

The Hall of Fame will be published on this page once the first credited disclosure is resolved.

Recognition

Recognition for a confirmed finding under this policy is public credit in the Hall of Fame. Any change to that, including a paid bug bounty program, will be announced on this page.

Contact

Security reports and PGP key requests go to [email protected]. AI governance issues, including bias reports and safety concerns, go to [email protected].

The machine-readable contact for this site is burna.ai/.well-known/security.txt, per RFC 9116.