Responsible Disclosure Policy

Email marcus@dentorb.ai with a clear description, reproduction steps, and any supporting material. Encrypt sensitive details if you can — request our PGP key in your initial message.

• Acknowledge your report within 2 working days.
• Provide a triage decision within 10 working days.
• Keep you updated on remediation.
• Credit you publicly when the issue is fixed, if you'd like.

• dentorb.ai and dental.dentorb.ai.
• The dentorb production application and APIs.
• Out of scope: third-party services, sub-processor infrastructure, and anything you have not been authorised to test.

• Don't access, modify or destroy data that isn't yours.
• Don't run automated scanners that could degrade service for real users.
• Stop and contact us as soon as you have proof of a vulnerability.
• Keep findings confidential until we've had reasonable time to fix.

If you act in good faith, follow this policy and respect the rules of engagement, we will not pursue or support legal action against you for your research, and we will treat your activities as authorised under the Computer Misuse Act 1990.

• Reports from automated tools without verified impact.
• Best-practice configuration suggestions without a demonstrable vulnerability.
• Self-XSS and clickjacking on pages without sensitive actions.
• Missing security headers without a working exploit.