Vulnerability Disclosure Programme
Qure.ai takes the security of its products and the safety of the patients they serve seriously. We welcome reports of suspected security vulnerabilities from researchers, customers and the public, and we commit to handling every report promptly and transparently.
Scope
This programme covers:
- All Qure.ai commercial products, including cloud-hosted
- Qure.ai infrastructure supporting those products, including hosted environments and Qure.ai-operated domains and web properties
Out of scope: third-party services Qure.ai does not operate; customer-operated systems and networks; findings that require physical access to customer premises; reports produced solely by automated scanning tools without a demonstrated impact; social engineering of Qure.ai staff or customers; and denial-of-service testing against production systems.
How to report
- Prepare your report using the format below.
- Email it to informationsecurity@qure.ai . Encrypt sensitive details before sending them.
- You will receive an acknowledgement with a tracking reference within 2 business days.
- Do not publicly disclose the vulnerability until we have confirmed remediation or agreed a disclosure date with you.
No account, contract or non-disclosure agreement is required to submit a report.
Information to Include
| Field | What to provide |
|---|---|
| Reporter details | Name or handle, contact email, and whether you wish to be publicly credited |
| Date of discovery | Date and time (with timezone) the issue was identified |
| Affected product or asset | Product name and version, or URL, hostname or IP address |
| Vulnerability type | e.g. authentication bypass, injection, memory corruption, information disclosure, misconfiguration |
| Severity assessment | Your assessment of severity, with CVSS v3.1 vector if available |
| Description | What the issue is and why it matters |
| Reproduction steps | Numbered steps allowing Qure.ai to reproduce the issue reliably |
| Proof of concept | Request and response captures, scripts, screenshots or video. Do not include real patient data |
| Impact | What an attacker could achieve, and the preconditions required |
| Test environment | Source IP used, browser or client, and any account used during testing |
| Suggested remediation | Proposed fix or mitigation |
| Disclosure preference | Whether you intend to publish, and your preferred timeline |
| Supporting files | Logs, captures, or sample files. Encrypt with the published PGP key if sensitive |
