Report a vulnerability
Protecting people's health data is our top priority. If you've found a vulnerability anywhere in the Vittae360 ecosystem, we want to know. We review every report and recognize those who help us keep our users safe.
Email us at seguridad@vittae360.com.
So we can reproduce and fix the issue quickly, please include:
- Which component or URL is affected.
- Steps to reproduce it.
- A proof of concept and the potential impact.
- A way to contact you.
We acknowledge receipt within 3 to 5 business days and keep you updated until resolution.
Scope
The program covers our entire ecosystem, including:
- Website and vittae360.com subdomains.
- Mobile app and PWA.
- Programmatic access: APIs and SDKs.
- Backend and service infrastructure.
Any component or subsystem is in scope if it affects the confidentiality, integrity or availability of health data. We do not publish an exhaustive list of our systems.
Rules and safe harbor
We ask you to research in good faith:
- Use test accounts; do not access, modify or exfiltrate real people's data —especially protected health information (PHI).
- Do not degrade or disrupt the service.
- Keep the finding confidential until we have fixed it.
If you research in good faith and in accordance with these rules, we consider your activity authorized, we will not pursue legal action against you, and we will work with you to resolve the finding.
Out of scope
- Denial-of-service attacks (DoS/DDoS).
- Social engineering or phishing of our staff.
- Physical attacks and spam.
- Automated scanner output without a proof of concept.
- "Best practice" reports without a demonstrable security impact.
Recognition
With your permission, we publicly thank those who report valid vulnerabilities. We don't offer guaranteed payouts for now, but we do give recognition at our discretion.
Learn more about our security posture on Compliance and our Trust Center ↗.