Security and Responsible Disclosure
How we protect AllergyNest, how to report a security vulnerability, and the rules for good-faith security research.
Policy update, October 28, 2026: you can now sign up for food allergen recall alerts by email. Our Privacy Policy, Consumer Health Data Privacy Policy and Terms of Use explain what a recall alert sign-up keeps, that alerts go only to confirmed addresses, and what the alerts can’t do.
October 19, 2026: doctors in our allergist directory, and the people who work at their practices, can now claim their listing. Our Privacy Policy, Cookie Policy and new Directory Listing Terms explain what a clinic account keeps. Readers still don’t need an account, and our pages still set no cookies for them.
October 17, 2026: you can now sign up for pollen alert emails. Our Privacy Policy and Consumer Health Data Privacy Policy explain what a sign-up keeps and how to delete it.
If you find a security problem on AllergyNest, we want to hear about it. We welcome reports from good-faith researchers who follow the rules below.
How we protect the site
- Every page is served over HTTPS.
- Secrets, such as API keys and database credentials, are kept out of our code. They are stored in our hosting provider’s encrypted settings.
- Access to our systems is limited to the people who need it.
- The only personal information in our database is alert sign-ups, an email address with a metro or a list of food allergens for each person who signs up, and clinic accounts, which doctors and practice staff use to manage a directory listing. Unsubscribing deletes a sign-up. The database also holds our list of metro areas, pollen values and the details practices add to their listings.
- There are no passwords. Clinic accounts sign in with a link we email, which works once and expires after 15 minutes. Codes in confirm links, sign-in links and sign-in cookies are stored only in hashed form, and the sign-in cookie can’t be read by scripts on the page.
- Apart from our hosting provider’s visit counter, served from our own domain, our pages load no outside scripts.
Report a vulnerability
Email hello@allergynest.com with “Security” in the subject line. Please include:
- a description of the problem and what an attacker could do with it;
- the steps to reproduce it;
- the address (URL) of the affected page or endpoint.
We aim to acknowledge your report within 5 business days. We may contact you if we need more details.
Our security.txt file, at /.well-known/security.txt, gives the same contact details in a standard machine-readable format.
Rules for good-faith research
When you look for vulnerabilities:
- Test only allergynest.com. Don’t test the systems of our service providers, such as Vercel, Neon, GitHub, GoDaddy or Google. They have their own rules.
- Don’t access, change or delete data that isn’t yours.
- Don’t run denial-of-service attacks or load tests.
- Don’t use social engineering, such as phishing, and don’t attempt physical attacks.
- Don’t run automated scans that put a burden on the site.
- Stop as soon as you find a problem, and report it to us. Don’t go further than you need to show it.
- Keep the details private until we have had reasonable time to fix the problem.
Safe harbor
If you research AllergyNest in good faith and follow these rules, we will not pursue or support legal action against you for that research.
This commitment covers AllergyNest only. We can’t authorize testing of systems that belong to anyone else.
No bug bounty
We don’t run a bug bounty program, and we don’t pay for reports. Thank you for helping keep AllergyNest safe.
Questions about this page? Email hello@allergynest.com.