Skip to main content

​
Contact

Report security issues to security@medisync.me. Please use this address rather than the public support channels or a GitHub issue, so that a potential vulnerability is not disclosed publicly before it is fixed. If you cannot reach us at that address, write to support@medisync.me and ask to be put in touch with the security team — do not include the technical details in that first message.

​
What to include

The more of this you can provide, the faster we can reproduce and fix the issue:
The affected endpoint, hostname, or component — for example POST /api/documents/add/{id} on app.medisync.me, the Speech WebSocket, or the MediSync Agent.
Step-by-step instructions, a request/response pair, or a short proof-of-concept. Please redact any credentials or patient data from what you send us.
What an attacker could achieve — read another doctor’s data, escalate privileges, bypass authentication, deny service. Your assessment of severity is useful even if we end up scoring it differently.
Roughly when you observed it, and whether it is still reproducible.

​
Testing guidance

MediSync processes patient data, so please keep your testing within these bounds:
  • Use your own account and your own test data. Do not access, modify, or store data belonging to any other account. If you encounter patient data by accident, stop, do not save a copy, and tell us what happened in your report.
  • No denial-of-service testing, load testing, or resource-exhaustion attempts against production.
  • No social engineering, phishing, or physical attempts against MediSync staff, customers, or practices.
  • No automated scanning that generates significant traffic against production systems.
  • Prefer a trial or test account over a live practice environment.
If a proof-of-concept would require crossing any of these lines, describe the issue and stop there — we would rather confirm it ourselves than have it demonstrated against real data.

​
What happens next

1

Acknowledgement

We confirm we received your report and let you know who is handling it.
2

Triage

We reproduce the issue, assess impact, and tell you whether we consider it a vulnerability and roughly how we intend to handle it.
3

Remediation

We fix confirmed issues, prioritized by severity, and keep you updated while we do.
4

Closure

We confirm the fix is deployed. With your permission, we are happy to credit you publicly once the issue is resolved.
We will not pursue legal action against researchers who report issues in good faith, follow the testing guidance above, and give us a reasonable opportunity to fix the issue before disclosing it publicly.
MediSync does not currently run a paid bug bounty programme. Reports are still very welcome, and we credit researchers who want to be named.

​
Not a security issue?

For anything that is not a suspected vulnerability — integration questions, account access, billing, or a bug that has no security impact — email support@medisync.me, which is monitored during business hours.