Security

Report a security problem

We want MERIT Lumina to be safe for the care providers who use it and the people they support. If you find a security weakness, please tell us. We will work with you to fix it.

Report a problemHall of Fame

What you can test

  • meritlumina.com.au and its subdomains: the web app, its APIs, sign-in (Microsoft and two-step codes), AI features and Microsoft Fabric connections.
  • Use only your own account and your own test data.

What you must not test

  • Our hosting providers' hardware and networks, Anthropic's AI services, Cloudflare's network, and other companies' services we use.
  • Denial of service, flooding, spam or high-volume scanning.
  • Phishing, tricking our staff or customers, or physical access.
  • Changing, deleting or copying data that is not yours.

Rules for testing

  • Use the smallest proof that shows the problem, for example SELECT version() instead of reading tables.
  • If you see other people's data, health information or passwords, stop at once, delete what you saw, and tell us.
  • Do not lock out, change or disrupt other people's accounts.
  • Delete your logs, screenshots and recordings within 30 days after we tell you the problem is fixed.

Keep it private

  • Keep the details private. Our standard private period is 90 days from our first reply, or 30 days if attackers already use the problem.
  • Before anything is published, we both agree in writing.

If your organisation uses MERIT Lumina

  • Report anything you notice here.
  • Active testing of the platform needs our written approval first, as your agreement with us says.

Our promise

If you follow these rules and act in good faith, we treat your research as authorised. We will not take legal action against you for it. If someone else does, we will say that you were authorised. This covers only systems we own, and you must still follow the law.

What happens next

  • You get a reference number at once, and a private link by email.
  • We check your report within 2 business days (Brisbane time).
  • You follow your report and write to us on your private page.

We aim to fix confirmed problems within:

  • 14 daysCritical
  • 30 daysHigh
  • 60 daysMedium
  • 90 daysLow

What we do not accept

  • A problem we already know about.
  • Reports from testing that breaks these rules.
  • Spam or flooding.
  • Missing email settings (SPF, DKIM, DMARC) without a working attack.
  • Software version numbers shown in pages or headers.

Thanks

  • We do not pay money for reports.
  • With your permission, we add your name to our Hall of Fame after the fix.