Vulnerability disclosure
How to report a security vulnerability in EDFlow: scope, safe-harbour rules, what to include, what never to do with patient data, response times, and security.txt.
We welcome reports from security researchers and hospital teams. The contact address and encryption key are published in /.well-known/security.txt on the product site (https://edflow.space/.well-known/security.txt).
Scope
- The web app, patient and family web, staff console and admin.
- The iOS and Android apps.
- The Integration API and the sandbox.
- This documentation site.
Test only against the sandbox and the showcase, which hold synthetic data. Never test against a hospital's customer-test or live environment.
Rules
- Don't access, change or keep data that isn't yours. If you reach real patient data by accident, stop, don't copy it, and tell us right away.
- Don't run denial-of-service tests, spam, social engineering or physical attacks.
- Don't use automated scanners that send large volumes of requests.
- Give us reasonable time to fix before you disclose publicly.
If you follow these rules in good faith, we won't pursue legal action and will work with you on disclosure.
What to include
- The affected URL, endpoint or app version.
- Steps to reproduce, with synthetic data only.
- The impact you believe it has.
- Any
Request-Idfrom responses.
Our commitments
| Step | Target |
|---|---|
| Acknowledge your report | 2 business days |
| Initial assessment | 5 business days |
| Fix critical vulnerabilities | 72 hours |
| Tell you when it's fixed | On release |
If a report reveals a possible breach of a hospital's data, we follow the breach process in Availability and incidents and notify the custodian within 24 hours.
Related
Last updated on