PreggyAI
Security & Vulnerability Disclosure
PreggyAI holds health information about pregnant people. That makes security reports genuinely valuable to us, and it is why this page exists rather than a silence you would have to interpret. If you have found a problem, please tell us before you tell anyone else — and know in advance how we will respond.
How to report
Email security@preggyai.online. Include what you found, how to reproduce it, and what you think the impact is. A rough report you are unsure about is welcome; we would rather triage a false positive than miss a real one.
The machine-readable version of this contact is at /.well-known/security.txt (RFC 9116).
What we promise
- We acknowledge every report within 5 business days. If you have not heard from us in that time, assume the mail failed and try again.
- We will tell you what we concluded — including when we decide something is not a vulnerability, and why.
- We will tell you when it is fixed.
- We will not pursue legal action, or ask anyone else to, for good-faith research that stays inside the boundaries below. We will not treat it as a breach of our Terms of Use.
- We will credit you by name or handle if you want it, and stay quiet about you if you do not.
We do not run a paid bug bounty. We are a small operation and would rather tell you that plainly than imply a reward that is not coming.
Boundaries
Good-faith research means:
- Use your own account. Do not access, modify, download, or retain another person's data to demonstrate a finding. A description of the flaw is enough — we can reproduce it ourselves.
- If you see someone else's information by accident, stop and tell us. That is a report, not a violation, and we will treat it as one. Tell us what you saw so we can meet our own breach-notification duties, then delete it.
- No denial of service, load testing, or automated scanning that degrades the service for the people using it.
- No social engineering of our users, our support address, or our providers, and no physical attempts against anyone.
- Give us a reasonable chance to fix it before publishing. Tell us your intended disclosure timeline and we will tell you honestly whether we can meet it.
Out of scope
Reports we will acknowledge but generally will not action: missing security headers with no demonstrated impact, results from automated scanners with no working proof of concept, issues requiring a rooted or jailbroken device, social-engineering scenarios, and best-practice recommendations unattached to a concrete vulnerability.
Our authenticated API endpoints are intentionally reachable without a network-level gate — authorization is enforced per request inside each endpoint. An endpoint being publicly addressable is therefore not itself a finding; an endpoint returning data it should not is.
If a report becomes an incident
If your report shows that user data was actually exposed, it starts our incident-response process, and we may be legally required to notify affected users and one or more regulators. We will tell you if that happens. We may ask you for detail about timing and scope, because those notifications have to be accurate.
Contact
Security reports: security@preggyai.online. Privacy questions and requests go to our Privacy Officer at privacy@preggyai.online — see the Privacy Policy. PreggyAI is operated by Injoy AI Solutions Inc., registered in British Columbia, Canada.