How the site is protected
- In transit
- HTTPS everywhere, with HSTS instructing browsers to refuse an unencrypted connection to this domain for two years.
- At rest
- The database and the object storage are encrypted by the provider. Admin passwords are bcrypt hashes and are not recoverable by anyone, including us.
- Access
- The console requires an account, sessions expire, and access is granted per person and removed when it is no longer needed.
- Audit
- Every administrative action is written to an append-only trail with the account, the time, the address and the browser.
- Isolation
- A strict content-security policy blocks scripts, frames and connections the site did not ask for. Framing the site from another origin is refused outright.
- Abuse
- Public forms are rate-limited per address, and every field is validated and sanitised before it reaches storage.
- Minimisation
- The strongest control here is what is absent: no payment data, no clinical records and no accounts are held on this website.
Reporting a vulnerability
Email security@aslam.clinic. Tell us what you found, how to reproduce it, and what an attacker could do with it. Please give us a way to reach you, and please give us time before publishing.
- Acknowledgement
- Within 3 working days.
- Assessment
- A severity judgement and a plan within 10 working days.
- Fix
- Critical issues within 7 days; everything else on a schedule we tell you.
- Credit
- Named on this page if you would like to be, once the fix is live.
- Disclosure
- Coordinated. 90 days is a fair default, and we will not ask you to sit on something indefinitely.
Safe harbour
Research conducted in good faith and within the rules below is authorised by us. We will not pursue a legal complaint, and if a third party does, we will state publicly that your testing was authorised.
- Test only aslam.clinic and its subdomains. Our suppliers' systems are not ours to authorise.
- Do not access, modify, download or retain anybody's personal data. If you stumble into some, stop, and tell us what you saw so we can measure the exposure.
- No denial of service, no load testing, no spam through our forms, and no social engineering of our staff or patients.
- Do not degrade the service. This is a working clinic and its phone line is a patient's route to care.
- Give us reasonable time to fix before you publish.
Out of scope
Missing headers with no demonstrated impact, rate-limit findings without a working bypass, self-XSS, results from an automated scanner with no exploit path, and reports about third-party services we do not run.
If patient data is ever exposed
A suspected breach reaches the privacy officer within 24 hours, is contained and assessed immediately, and — where there is a real risk to anyone — is reported to the relevant supervisory authority within 72 hours and told to the people affected without undue delay. We tell you what happened, what it means for you and what we did, and we publish what we changed so it does not happen twice. The full procedure is at /legal/governance.