NoHarm is used in hospitals to prevent adverse drug events. A vulnerability here can affect patient safety and patient privacy, so we take reports seriously and respond to them quickly.
Security fixes are applied to the latest released version. Older versions are not patched — upgrade to the current release before reporting an issue you found on an old one.
Please do not open a public issue for a security problem.
Use GitHub's private vulnerability reporting instead:
- Go to https://github.com/noharm-ai/backend/security/advisories/new (the Security tab of this repository → Report a vulnerability).
- Describe the issue, the affected version or commit, and the impact.
- Include the steps needed to reproduce it, and a proof of concept if you have one.
If private reporting is unavailable to you, open an issue that says only that you have found a security problem and would like a private channel — no details — and a maintainer will follow up.
| Stage | Target |
|---|---|
| Acknowledgement of the report | Within 5 working days |
| Initial assessment and severity | Within 10 working days |
| Fix or mitigation for a confirmed high-severity issue | As quickly as the fix allows, prioritized over feature work |
| Public disclosure | After a fix is released, crediting the reporter unless they prefer otherwise |
- Test against a production instance, or against any instance you do not own.
- Access, modify or exfiltrate data that is not yours. This is a healthcare system; real patient records may be involved.
- Run denial-of-service or load tests against hosted environments.
Test against a local installation instead — the installation guide sets one up with synthetic seed data.
In scope: authentication and session handling, the authorization and permission model, cross-tenant data access, injection flaws, sensitive data exposure, insecure defaults in the shipped configuration, and vulnerable dependencies with a demonstrated path to exploitation.
Out of scope: findings that require a compromised host or database, issues in third-party services we merely integrate with, missing hardening headers with no demonstrated impact, and reports generated by a scanner with no analysis of exploitability.
Never commit real data — patient records, credentials, hospital hostnames,
client identifiers, e-mail addresses, CPF or CNS numbers — to this repository,
in code, tests, fixtures, comments or commit messages. Use obviously fictitious
placeholders (Fulano Beltrano, fulano@example.com, clearly invalid document
numbers). See CONTRIBUTING.md.
If you find such data already committed, report it through the private channel above rather than opening an issue.