Security and responsible disclosure

Scope

This policy covers the domain ravisanthealth.com and its subdomains. The site is static: it has no user accounts, no login, no database, no forms and no server-side code that executes on visitor input.

It does not cover the Ravisant Platform. The platform's security architecture, its audit receipts and the verification gates that enforce them are documented in the technical package and examined during due diligence, not published here.

How to report

Write to info@ravisanthealth.com with the subject line "Security". Please include what you found, where, and the smallest set of steps that reproduces it. Send it in whatever language you are most precise in — English, French and Spanish are all read here.

What we undertake

• We acknowledge every report within three business days.
• We tell you what we assess it to be and what we intend to do.
• We credit you by name if you would like to be credited, and we will not name you if you would not.
• We will not pursue or support legal action against anyone acting in good faith under this policy.

What we ask of you

• Give us a reasonable opportunity to fix the issue before disclosing it publicly.
• Do not degrade the service: no denial-of-service, no volumetric or automated scanning that generates load.
• Do not use social engineering, phishing or physical means against anyone.
• If you encounter data that is not yours, stop, do not copy it, and tell us.

Out of scope

Reports generated by automated scanners with no demonstrated impact; missing hardening headers with no exploitable consequence; issues in our host's infrastructure, which should be reported to the host; and the content of the site as a matter of opinion.

Machine-readable policy

This policy is also published at /.well-known/security.txt, in the format of RFC 9116.