Report a weakness
Vulnerability disclosure
If you think you have found a security weakness in Oxonia, we want to hear from you. This page explains how to report it and what happens next.
How to report
Last updated: 10 October 2026.
Email security@oxonia.ai. Our contact details are also published in machine-readable form at oxonia.ai/.well-known/security.txt. Please include:
- what you found and where, such as the product, address and page;
- steps to reproduce it, and any proof-of-concept;
- what an attacker could do with it; and
- how to contact you, if you would like a reply.
Please do not include personal data unless it is needed to explain the issue. If it is, tell us, so we can handle the report with extra care and delete what we no longer need once the issue is fixed.
Scope
- In scope: the oxonia.ai website and Oxonia products on oxonia.ai addresses, such as id.oxonia.ai and scribe.oxonia.ai, and our mobile apps.
- Out of scope: denial-of-service testing, social engineering, physical attacks, spam, reports from automated scanners without a demonstrated impact, and systems run by universities or third parties, such as a university's own sign-in or learning platform.
What we ask of you
- Act in good faith and test only what you need to show the problem.
- Do not view, change, keep or share data that is not yours. If you see personal data by accident, stop and tell us.
- Do not disrupt the service, for example by flooding it with traffic.
- Use only your own test accounts, and do not target students or staff.
- Give us reasonable time to fix the issue before you tell anyone else. We suggest 90 days, or sooner once it is fixed.
What you can expect from us
- We acknowledge your report within 3 working days.
- We tell you our initial assessment within 10 working days and keep you updated while we work on it.
- We tell you when the issue is fixed, and agree with you when it can be disclosed.
- With your permission, we thank you publicly. We do not run a paid bug bounty programme at present.
Safe harbour
If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not take legal action against you or report you to law enforcement for it, and we will make that clear to anyone else who does. If a university or another party is affected, we will let them know you acted in good faith. If in doubt about whether something is allowed, ask us first at security@oxonia.ai.
Universities' own users
Students and staff who notice something wrong, such as seeing another person's records, should tell their university's IT service desk straight away, and may also email security@oxonia.ai. Universities should report suspected incidents to security@oxonia.ai at any time. See the security overview and penetration testing.
Related