Trust
Vulnerability disclosure
If you believe you have found a security issue in an Afloat website or service, we want to hear about it.
How to report
Email security@afloathub.com. Please include:
- What you found and where (URL or system).
- Steps to reproduce it, and any proof-of-concept.
- Your contact details, if you would like a reply.
Machine-readable contact details are in our security.txt file.
What to expect
- We will acknowledge your report within 3 business days.
- We will investigate, keep you informed, and tell you when it is fixed.
- We will not take legal action against good-faith research that follows this policy.
Ground rules
- Do not access patient data. If you encounter PHI or any customer data, stop immediately, do not copy or keep it, and tell us.
- Do not disrupt services: no denial-of-service, spam, or load testing.
- Do not use social engineering or physical attacks against our staff or customers.
- Give us reasonable time to fix an issue before you share it publicly.
- Only test systems you are authorized to test. Hospital customer environments are out of scope, so please report issues you notice in them to us rather than testing them.
Scope
In scope: www.afloathub.com and Afloat web applications we operate. We do not run a paid bug bounty program at this time.
We review this page periodically and may update it. Questions about it? Email contact@afloathub.com.