> ## Documentation Index
> Fetch the complete documentation index at: https://docs.medisync.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Reporting a vulnerability

> How to report a security issue in the MediSync API, and what to expect after you do

## Contact

Report security issues to **[security@medisync.me](mailto:security@medisync.me)**.

Please use this address rather than the public support channels or a GitHub issue, so that a potential vulnerability is not disclosed publicly before it is fixed. If you cannot reach us at that address, write to [support@medisync.me](mailto:support@medisync.me) and ask to be put in touch with the security team — do not include the technical details in that first message.

## What to include

The more of this you can provide, the faster we can reproduce and fix the issue:

<AccordionGroup>
  <Accordion icon="crosshairs" title="Where">
    The affected endpoint, hostname, or component — for example `POST /api/documents/add/{id}` on `app.medisync.me`, the Speech WebSocket, or the MediSync Agent.
  </Accordion>

  <Accordion icon="list-ol" title="How to reproduce">
    Step-by-step instructions, a request/response pair, or a short proof-of-concept. Please redact any credentials or patient data from what you send us.
  </Accordion>

  <Accordion icon="circle-exclamation" title="Impact">
    What an attacker could achieve — read another doctor's data, escalate privileges, bypass authentication, deny service. Your assessment of severity is useful even if we end up scoring it differently.
  </Accordion>

  <Accordion icon="clock" title="When">
    Roughly when you observed it, and whether it is still reproducible.
  </Accordion>
</AccordionGroup>

## Testing guidance

MediSync processes patient data, so please keep your testing within these bounds:

* **Use your own account and your own test data.** Do not access, modify, or store data belonging to any other account. If you encounter patient data by accident, stop, do not save a copy, and tell us what happened in your report.
* **No denial-of-service testing**, load testing, or resource-exhaustion attempts against production.
* **No social engineering**, phishing, or physical attempts against MediSync staff, customers, or practices.
* **No automated scanning** that generates significant traffic against production systems.
* Prefer a **trial or test account** over a live practice environment.

If a proof-of-concept would require crossing any of these lines, describe the issue and stop there — we would rather confirm it ourselves than have it demonstrated against real data.

## What happens next

<Steps>
  <Step title="Acknowledgement">
    We confirm we received your report and let you know who is handling it.
  </Step>

  <Step title="Triage">
    We reproduce the issue, assess impact, and tell you whether we consider it a vulnerability and roughly how we intend to handle it.
  </Step>

  <Step title="Remediation">
    We fix confirmed issues, prioritized by severity, and keep you updated while we do.
  </Step>

  <Step title="Closure">
    We confirm the fix is deployed. With your permission, we are happy to credit you publicly once the issue is resolved.
  </Step>
</Steps>

We will not pursue legal action against researchers who report issues in good faith, follow the testing guidance above, and give us a reasonable opportunity to fix the issue before disclosing it publicly.

<Note>
  MediSync does not currently run a paid bug bounty programme. Reports are still very welcome, and we credit researchers who want to be named.
</Note>

## Not a security issue?

For anything that is not a suspected vulnerability — integration questions, account access, billing, or a bug that has no security impact — email [support@medisync.me](mailto:support@medisync.me), which is monitored during business hours.