Responsible Vulnerability Disclosure

1. OUR COMMITMENT

AverCare takes the security and privacy of our users, systems and information seriously.

We welcome responsible reports from security researchers, users and other third parties who believe they have identified a potential security vulnerability affecting an AverCare-controlled system or service.

We ask that security research is conducted responsibly, in good faith and in a manner that protects our users, their information and the availability of our services.

This Responsible Vulnerability Disclosure programme provides a channel through which potential security vulnerabilities affecting AverCare-controlled systems and services may be responsibly reported to AverCare.

2. HOW TO REPORT A VULNERABILITY

If you believe you have identified a security vulnerability affecting AverCare, please report it privately to:

Security Contact: security@avercare.global
Website: www.avercare.global

Please provide as much relevant information as reasonably possible, including:

• the affected system, application, URL or endpoint;
• a description of the suspected vulnerability;
• steps required to reproduce the issue;
• the potential security impact;
• relevant screenshots or technical evidence; and
• your contact information or researcher alias if you would like us to communicate with you regarding the report.

Please do not include unnecessary personal, health or other sensitive information in your report.

3. SCOPE

Responsible vulnerability reports may relate to AverCare-controlled:

• web applications;
• mobile applications;
• APIs and backend services;
• authentication and access-control mechanisms;
• cloud infrastructure;
• databases and storage systems;
• AI/ML application interfaces;
• integrations controlled by AverCare;
• application, deployment and security configurations where they affect an AverCare-controlled service; and
• other AverCare-operated internet-facing systems.

Third-party products, platforms or infrastructure that AverCare does not control may fall outside the scope of this programme.

Testing of third-party systems is not authorised under this programme unless AverCare has the authority to permit such testing.

4. GOOD-FAITH SECURITY RESEARCH

We ask researchers to:

• test only to the extent reasonably necessary to demonstrate a vulnerability;
• avoid unnecessary access to personal, health, confidential or sensitive information;
• avoid disrupting or degrading AverCare services;
• not modify, delete, corrupt or destroy information;
• not intentionally compromise user accounts;
• not use an identified vulnerability for personal, financial, commercial or other improper gain;
• report identified vulnerabilities privately to AverCare;
• provide AverCare with reasonable time to investigate and remediate a vulnerability before public disclosure; and
• comply with applicable law.

Researchers should stop testing once sufficient information has been obtained to reasonably demonstrate the existence and potential impact of a vulnerability.

5. ACTIVITIES NOT PERMITTED

This disclosure programme does not authorise:

• denial-of-service or distributed denial-of-service attacks;
• destructive or disruptive testing;
• social engineering or phishing;
• installation of malware or malicious code;
• use of stolen credentials;
• intentional access to another user's account;
• unnecessary access, downloading or retention of personal or health information;
• alteration or deletion of user information;
• physical-security attacks;
• extortion or demands for payment in exchange for withholding disclosure;
• exploitation or testing beyond what is reasonably necessary to demonstrate the existence and potential impact of a vulnerability;
• exploitation of vulnerabilities for personal, financial, commercial, fraudulent, unlawful or harmful purposes; or
• testing of third-party systems that AverCare does not have authority to permit you to test.

Conduct falling outside these requirements is not authorised under this Responsible Vulnerability Disclosure programme.

6. IF YOU ENCOUNTER PERSONAL OR HEALTH INFORMATION

If you unintentionally encounter personal information, health information or other sensitive information during good-faith security research:

• stop accessing the information;
• do not copy or retain it unnecessarily;
• do not share or disclose it;
• securely delete unnecessary local copies; and
• notify AverCare promptly through the security contact above.

Please provide sufficient technical information for us to investigate without sending unnecessary sensitive information.

7. WHAT HAPPENS AFTER YOU REPORT

AverCare will make reasonable efforts to:

• acknowledge your report;
• assess and validate the reported vulnerability;
• request additional information where necessary;
• investigate and prioritise the issue according to risk;
• remediate, mitigate or otherwise appropriately address validated vulnerabilities where required;
• verify applicable remediation; and
• advise you when the matter has been resolved or closed where appropriate.

We may limit information provided about an investigation where necessary to protect security, privacy, confidentiality or ongoing investigations.

The nature and timing of remediation or other risk-treatment activities may vary depending on the severity, complexity, affected systems and potential impact of the reported vulnerability.

8. COORDINATED DISCLOSURE

Please provide AverCare with reasonable time to investigate and remediate a reported vulnerability before publishing technical information that could place users or systems at risk.

Where public disclosure is appropriate, we encourage coordinated disclosure so that remediation can be made available before detailed vulnerability information is released.

Where reasonably possible, AverCare may coordinate with the reporter regarding:

• the timing of disclosure;
• technical information to be disclosed;
• remediation availability;
• affected services or systems; and
• appropriate security guidance.

AverCare may request that disclosure be delayed where remediation is actively underway and premature disclosure could materially increase risk to users, information or systems.

Nothing in this process is intended to prevent lawful reporting to an appropriate regulatory or law-enforcement authority.

9. SAFE HARBOUR

Where security research is conducted in good faith and in accordance with this Responsible Vulnerability Disclosure guidance, AverCare's intention is to treat that activity as authorised security research within the scope described here and not to pursue action solely because a researcher identified and responsibly reported a vulnerability.

This does not apply to:

• unlawful conduct;
• deliberate harm;
• extortion;
• privacy violations;
• service disruption;
• destructive activity;
• use of stolen credentials;
• exploitation for personal, financial, commercial, fraudulent or harmful purposes;
• exploitation beyond what is reasonably necessary to demonstrate the vulnerability; or
• conduct outside the scope of this Responsible Vulnerability Disclosure programme.

This safe-harbour statement does not authorise testing of systems or information controlled by third parties where AverCare does not have authority to grant such permission.

10. REWARDS

AverCare does not currently represent this disclosure programme as a bug-bounty programme.

Submitting a vulnerability report does not create an entitlement to payment, compensation, reward or other benefit unless AverCare has expressly agreed otherwise in writing.

Any future bug-bounty or reward programme established by AverCare will be governed by its own applicable terms and conditions.

11. CONTACT

Security vulnerabilities should be reported privately to:

Email: security@avercare.global
Website: www.avercare.global

Please do not send unnecessary personal information, health information, credentials or other sensitive information when submitting a vulnerability report.

This is the published version of AC-COM-RVDP-383, version 1.0. The signed original is retained on record.