Edit this page

Security Policy¶

Reporting a Vulnerability¶

Do not report suspected vulnerabilities through public issues.

Report them privately through GitHub's private vulnerability reporting for this repository if enabled, or email pews@openhealthtechnology.org.

Include a description of the issue and impact, affected versions or commit hashes, safe reproduction steps, and any suggested mitigation. Redact credentials and patient-identifiable or other sensitive data.

We aim to acknowledge reports within 2 working days and provide a substantive response within 5 working days.

Scope¶

This policy covers this repository. Report upstream dependency vulnerabilities to the relevant maintainer and notify us privately if they affect this project.

Safety-Relevant Reports¶

If the issue could affect patient safety, clinical workflow, or patient-identifiable data, flag that clearly. We will triage it as both a security finding and a potential safety hazard.

Disclosure¶

We use coordinated disclosure. After a fix is available, we will publish an appropriate advisory or release note and credit the reporter if they agree.