Vulnerability reporting

Report suspected vulnerabilities through the contact channel. Do not attach patient records.

Report suspected vulnerabilities without patient data.

Scope

Authorization bypass, credential fraud signals, and unexpected data exposure are in scope.