Security Vulnerability Disclosure

Please submit your findings by emailing our security team:

To help us investigate and resolve the issue as quickly as possible, please include the following information:

• Description of the vulnerability
• Affected product, service, URL, or system
• Steps required to reproduce the issue
• Potential impact of the vulnerability
• Supporting evidence such as screenshots, logs, or proof-of-concept details

Upon receiving a vulnerability report, HealthCompiler will:

• Acknowledge receipt of the report within a reasonable timeframe
• Review and validate the reported issue
• Assess the severity and potential impact
• Prioritize remediation based on risk and business impact
• Keep the reporter informed of progress where appropriate
• Notify affected customers when customer impact is identified or customer action is required

We request that researchers:

• Act in good faith and avoid violating privacy, confidentiality, or service availability
• Do not access, modify, or disclose customer data
• Do not exploit vulnerabilities beyond what is necessary to demonstrate their existence
• Allow HealthCompiler a reasonable period of time to investigate and remediate the issue before public disclosure

HealthCompiler supports responsible security research conducted in good faith. Activities performed in accordance with this policy and intended solely to identify and report security vulnerabilities will not be considered unauthorized activity.