AHI · Security

Security and reporting a vulnerability

If you have found a security problem, we want to hear about it, and we would rather hear it from you than read about it later.

How to report

Write to info@ahilife.ca. Tell us what you did, what you saw, and roughly when. A link or a screenshot helps. A person reads every report.

While you are testing, please do not access other people's information, and please do not degrade the service for anyone else. We will not pursue a good-faith reporter who stays within that line.

The machine-readable version of this contact lives at /.well-known/security.txt.

How the site limits the damage a breach could do

The public tools compute on your device, so there is no store of client answers on our side to be taken.
Pages ship with a content security policy, strict transport security, and no third-party code.
Access codes are signed and carry their own expiry. Expiry is how access ends, which means a code cannot outlive its window even if it is copied.
The keys that sign codes are never sent to a browser. Only the public half is published, which is all a page needs in order to check a code.

Status. We describe properties here, not internals. If you need more detail for a legitimate review, ask us at info@ahilife.ca and we will talk.