Vulnerability disclosure policy
Updated 17 October 2026If you believe you have found a security vulnerability in Salisan, please tell us. We welcome reports from anyone and will work with you to understand and fix the issue.
How to report
Email your report to the address below. Please do not share the details anywhere else, such as social media or public issue trackers, while we work on a fix.
What to include
- The affected URL, feature or component
- Steps to reproduce the issue
- The impact: what someone could do by exploiting it
- Your contact details, so we can reach you with questions and updates
Do not include real patient data or other personal data. If you came across any, describe what kind of data it was rather than copying it.
What happens next
We acknowledge your report within 3 business days. We keep you updated while we investigate and fix the issue, and let you know when it is resolved.
Safe harbour
We will not take legal action against good-faith security research that follows this policy. While you research, please:
- Access or keep no more data than you need to show the issue, and delete any data you obtained once you have reported it.
- Do not harm our users or degrade the service for anyone.
- Give us reasonable time to fix the issue before you disclose it publicly.
Out of scope
This policy does not cover:
- Social engineering, such as phishing our team or users
- Denial-of-service attacks
- Physical attacks on people, premises or equipment
- Third-party services that Salisan does not run