Vulnerability Disclosure Policy

Scope

In scope

• medchronosai.com and all subdomains.
• The Chronos API as reachable from the production app.
• Chronos-controlled infrastructure supporting the above, including the Aptible-hosted app and database and GCS buckets.

Out of scope

• DoS/DDoS testing.
• Social engineering or physical-security testing of personnel or facilities.
• Accessing, downloading, or modifying another customer's case data or account. Stop at proof of concept.
• High-volume automated scanning without prior coordination. Email security@medchronosai.com first.
• Third-party services we do not control. Report to the vendor; see our subprocessors.
• Physical device access or already-compromised-credential findings.
• Duplicate or purely informational findings.
• Spam, missing rate-limiting on non-sensitive endpoints, and self-XSS.

How to report

Email security@medchronosai.com with:

• A description of the vulnerability and its impact.
• Reproduction steps and the exact request or payload. Redact any real PHI or credentials observed.
• Affected URLs.
• Contact information if you want updates or credit.

Do not publicly disclose before we have had a chance to respond per the timeline below. We do not currently offer PGP; we will arrange a secure channel if needed.

Safe harbor

Good-faith research that complies with this policy will not be met with civil action or a law-enforcement referral from us. We consider it authorized under the Computer Fraud and Abuse Act (CFAA) and exempt from our Acceptable Use Policy and Terms of Service to the extent necessary for that research, within Scope and Rules of engagement only.

If a third party pursues legal action over compliant research, we will state publicly that it was authorized. This does not extend to testing another customer's account or data without their own authorization.

What to expect

• Acknowledgment: within 2 business days.
• Initial triage: within 5 business days.
• Status updates: at least every 10 business days until resolved.

Remediation targets

• Critical (PHI exposure, authentication bypass, or remote code execution): 15 days.
• High: 30 days.
• Medium/Low: next release cycle.

These are internal targets, not contractual SLAs. We ask at least 90 days (or until a confirmed fix, whichever comes sooner) before public disclosure, and offer credit unless the researcher declines.

Rules of engagement

• Test only your own account(s).
• Stop at proof of concept.
• Do not exfiltrate or retain data beyond what is needed; delete it once we confirm receipt.
• Use synthetic or test data only, never real PHI.
• Submit one report per issue, or one consolidated report per class.

Relationship to other policies

This policy sits alongside our Acceptable Use Policy and Terms of Service, with the Safe Harbor section as a narrow exception to both for compliant research.

Confirmed vulnerabilities go through our incident-response and change-management processes, including truthful-claims review for any fix touching a public trust claim.