Security — Responsible Disclosure
We take security seriously. Help us keep travel health data safe.
Contact
Scope (In scope)
- medova.health
- API routes at medova.health
- Next.js application (frontend + API routes)
- Supabase REST API (anon-key endpoints)
Out of Scope
- Hetzner hosting infrastructure (managed by provider)
- Third-party services (Supabase cloud, Stripe, Google Maps)
- DoS / DDoS attacks
- Social engineering
- Physical security
Rules of Engagement
- Do NOT destroy production data
- Do NOT attack availability (DoS/DDoS)
- Do NOT access other users' accounts without their consent
- Test only on your own test account
- Report findings to office@medova.health before public disclosure
What We Want to Find
- SQL Injection, XSS (stored/reflected), CSRF
- Authentication bypass, privilege escalation
- Insecure Direct Object Reference (IDOR)
- Exposed secrets / API keys in frontend
- Misconfigured CORS, missing security headers
- Rate limiting bypass
- Open redirects
Rewards
Medova is a pre-revenue project. We offer:
- Public Hall of Fame on our website (name/handle + finding description)
- LinkedIn Recommendation from the CEO (for significant findings)
- Portfolio reference for the researcher
- Video call: architecture Q&A session
- For critical CVEs: long-term recognition as security contributor
Process
- Send a report to office@medova.health
- Acknowledgment within 48 hours
- Severity assessment and verification within 7 days
- Fix and feedback within 30 days (Critical/P0: 7 days)
- Hall of Fame recognition after fix is deployed
Severity Classification
| Level | Example |
|---|---|
| Critical | RCE, full auth bypass, PII data leak |
| High | Privilege escalation, IDOR to other users' data |
| Medium | Stored XSS, CSRF on critical actions |
| Low | Missing headers, open redirect, info disclosure |
Security Infrastructure
- 858+ Row-Level Security (RLS) policies on Supabase
- Content Security Policy (CSP) with strict directives
- HSTS with preload (2-year max-age)
- Fail-closed rate limiting (Upstash Redis)
- ISO 27001 ISMS documentation (certification target: 2026-12)
- GDPR/DSGVO compliant (EU data processing)
Hall of Fame
Be the first to earn a spot here. Report a vulnerability to get recognized.