Responsible disclosure / in preparation

Care extends to reporting.

This process is in preparation. There is no approved channel for receiving, triaging, or responding to reports yet.

Intake is inactive

Do not send reports now. Do not guess email addresses or use third parties or public spaces as a substitute. This site's contact is only an inactive placeholder.

There is no promised response time, reward program, or authorization to test. This page provides no legal protection or permission to access systems.

If you notice a possible issue

  1. Stop exploring. Do not expand access, modify data, disrupt services, or access other people's information.
  2. Reduce exposure. Do not copy sensitive data or publish details that enable exploitation.
  3. Record the minimum in an environment you control. Note the affected page, context, and a description without personal data, secrets, or patient content.
  4. Wait for an explicitly approved channel. A future process should state its accepted scope and how to transmit a minimal report.

Before activating this process

We need to approve a domain mailbox, designate triage owners, delimit covered assets, and describe report handling and retention. Any timelines can only be published when supported by verified capacity.

The security discovery file points to this policy page. That address is not a monitored channel, and intake remains inactive.

Check the channel status