Vulnerability disclosure
Reporting a vulnerability
Laetoli builds systems that hold health records, land titles and school registers. If you have found a way to reach data you should not, we want to hear from you before anyone else does.
How to report
Email security@laetoli.tz. Tell us what you found, where you found it, and what an attacker could do with it. A reproduction, a request, or a short screen recording is worth more than a scanner report.
Machine-readable details are at /.well-known/security.txt. We read English and Swahili.
What to expect
- An acknowledgement within three working days.
- An assessment, and our intended fix, within ten working days.
- Credit in the fix notes, if you would like it.
- No legal action against research conducted under the terms below.
In scope
laetoli.tz and the production systems it links to, including THOS, SCFMIS, IRMP, TANROADS, TISEZA, SomaLabs, Shule OS and LaetoliHub.
Out of scope: reports generated entirely by an automated scanner with no demonstrated impact, missing headers with no exploit path, denial of service, social engineering, and physical attacks.
Please do not
- Access, modify or delete data belonging to anyone but yourself.
- Degrade a service that a clinic or a school depends on.
- Disclose the issue publicly before we have had a chance to fix it.
For anything that is not a security issue, write to our contact page.