Security and Vulnerability Disclosure

Reporting a security vulnerability

Biological Data, Inc. (d/b/a Ambitious Bio) welcomes reports from security researchers and others who believe they have found a vulnerability in our systems. If you find one, please email security@ambitious.bio with a description of the issue, the steps to reproduce it, and its potential impact. Please do not include any personal data or dataset contents you may have accessed.

Scope

In scope: ambitious.bio and its subdomains operated by Ambitious Bio.

Out of scope: services operated by third parties (including our trust center platform and any third-party hosting or data-sharing services), which should be reported to those providers directly; denial-of-service testing; social engineering or phishing of our personnel; physical attacks; and automated scanner output that does not demonstrate a security impact.

Our commitments

We will acknowledge your report within five business days, keep you informed of our progress, and let you know when the issue is resolved. We ask that you give us a reasonable opportunity to fix the issue before disclosing it publicly.

Safe harbor

We will not pursue legal action against anyone who, in good faith, reports a vulnerability under this policy, provided they: access only the minimum data needed to demonstrate the issue; do not modify, delete, or retain any data; do not degrade or disrupt our services; and do not disclose the issue publicly before we have had a reasonable opportunity to address it.

Rewards

We do not currently offer a paid bug bounty. We are grateful for responsible reports and, with your permission, will acknowledge your contribution.