Responsible Disclosure
We welcome reports from security researchers and customers. If you believe you have found a vulnerability in DocAI Fabric, tell us and we will work with you to fix it.
Last updated: 2026-09-18.
How to report
Email security@docaifabric.com with:
- A description of the issue and its impact
- Steps to reproduce (requests, screenshots, or a proof of concept)
- The environment you tested against and the account you used
- How you would like to be credited, if at all
Encrypt sensitive details if you wish; ask us for a PGP key by email first.
What we commit to
| Step | Our commitment |
|---|---|
| Acknowledgement | Within 2 business days |
| Triage and severity | Within 5 business days, with an initial assessment |
| Fix | Critical within 7 days, High within 30 days, Medium within 90 days; Low in the next quarterly round |
| Updates | We keep you informed of progress and tell you when the fix is deployed |
| Credit | With your agreement, we acknowledge you when we publish the fix |
We do not currently run a paid bug-bounty programme.
Scope
In scope: app.docaifabric.com, au.docaifabric.com, docaifabric.com, the public API, and the DocAI Fabric container image.
Please test only against accounts you own. Create a free trial account for testing; do not access, modify or delete data belonging to anyone else. If you encounter another customer's data by accident, stop, do not retain it, and tell us immediately.
Out of scope
- Denial-of-service or volumetric testing, and anything that degrades the service for other users
- Social engineering, phishing, or physical attacks against our staff or facilities
- Automated scanning that generates large volumes of traffic
- Findings in third-party services we use (report those to the vendor; we appreciate a copy)
- Reports based solely on version numbers, missing best-practice headers without a demonstrated impact, or self-XSS
Safe harbour
If you follow this policy in good faith, we will not pursue legal action against you for your research, and we will not report you to law enforcement. We consider research conducted under this policy to be authorised. If a third party takes action against you for activity that complies with this policy, we will make it known that your actions were authorised.
Our side of the bargain
We ask that you give us reasonable time to fix an issue before disclosing it publicly, and that you do not disclose customer data you may have seen. We will agree a disclosure timeline with you; our default is 90 days from your report or the deployment of the fix, whichever is earlier.