Ruka hadi maudhui makuu
Security

Security policy & responsible disclosure

Medcasts coordinates planned medical travel for international patients — the data we hold (case summaries, IDs, payment intent, treatment plans) is sensitive. If you find a vulnerability, we want to hear from you.

How to report

Email medcastsdigital@gmail.com with:

  • A short summary of the issue + impact
  • Steps to reproduce — minimal payload, no scraping
  • Optional PGP key (we'll set up encrypted reply if requested)

For urgent issues (active exploit), prefix the subject with [CRITICAL] — paged 24/7. Routine reports get a written acknowledgement within 2 business days and an initial assessment within 5.

In scope

  • medcasts.com + all *.medcasts.com subdomains
  • Public APIs at /api/v1/*
  • Patient portal token / session security
  • Admin authentication, authorization, session management
  • Stored data exposure (PHI, payment intent, contact details)
  • SSRF, RCE, SQLi, deserialization, auth-bypass
  • Stored XSS / DOM XSS in admin or patient portal

Out of scope

  • Self-XSS or social-engineering of Medcasts staff
  • Vulnerabilities in third-party services we use (report to them)
  • Best-practice findings without an exploit chain (missing security headers on a page that ships them everywhere else, etc.)
  • Rate-limit bypasses on read-only public endpoints
  • Outdated software disclosure with no exploit
  • Spam / abuse via the inquiry form (CSRF + rate-limit already gate it)

What we ask

  • Don't access patient data. If you find an exposure, stop, document, and report. We'll reproduce on our side.
  • Don't run automated scanners against production. Test on a fork or against the local dev server (instructions in the project README).
  • Don't disclose publicly until we've shipped a fix or we've agreed on a coordinated date (default 90 days).
  • One report per issue. Bundling chains is fine.

Recognition

We run a non-monetary acknowledgement program — every confirmed report gets a write-up on this page (with researcher name + report date, opt-in) and a reference letter for portfolio use. We're a small team and don't run a paid bounty program yet; we'll be transparent if that changes.

Reference

Trust + transparency

Related policies

Medcasts publishes its review process, conflict-of-interest stance, and data handling rules openly. The pages below are the load-bearing ones.