Report a vulnerability
Send reports to security@patientlock.net. Include the affected product or URL, a concise description, reproduction steps, observed impact, and enough evidence for us to validate the issue. Do not include secrets, PHI, or customer data unless specifically requested through an appropriate secure channel.
In scope
Good-faith research may cover PatientLock-operated public applications, APIs, VitalSec software, and Rusty components that the researcher owns or is expressly authorized to test.
Do not
- Access, alter, download, or retain customer data beyond what is necessary to demonstrate a finding.
- Disrupt service, perform denial-of-service testing, or degrade a customer's environment.
- Use social engineering, credential theft, physical intrusion, or persistence.
- Test a customer deployment or third-party service without that party's authorization.
- Exploit a vulnerability after sufficient evidence exists to report it.
Good-faith safe harbor
If you make a good-faith effort to follow this policy, avoid harm, and report the issue promptly, PatientLock will treat your research as authorized for purposes of our enforcement of PatientLock's own access rules and will not initiate legal action against you for the research activity solely because it identified a vulnerability. This safe harbor cannot bind third parties or override applicable law.
Our process
PatientLock will review reports, validate reproducible findings, prioritize remediation based on risk, and coordinate disclosure when appropriate. Response and remediation timing depends on severity, exploitability, affected components, supplier involvement, and the complexity of a safe fix; this policy does not create a contractual remediation SLA.
Third-party systems
Vulnerabilities in SilverSky, Supabase, Vercel, KnowBe4, SentinelOne, Stripe, or another third-party service should generally be reported through that provider's disclosure process unless the issue arises from PatientLock's configuration or integration.