Vulnerability Disclosure Policy

Pomelo takes the security of our systems and the information entrusted to us seriously. If you believe you’ve found a security vulnerability in one of our systems listed below, we want to hear about it. This policy explains what’s in scope, how to report, what we ask of you, and what you can expect from us. It doesn’t authorize testing of any other system, including third-party services or vendor infrastructure.

Scope

In scope:

• pomelocare.com and its subdomains, including www, app, and info
• The Pomelo mobile apps on iOS and Android
• Public-facing APIs that serve the sites and apps listed above

Out of scope:

• Any system not listed above. If you come across an issue in another Pomelo system, you can still report it to us, but please don’t test it.
• Third-party services we use (for example, scheduling, email, or form vendors). Report those to the vendor directly.
• Denial of service, load testing, or anything that degrades service for patients.
• Social engineering, phishing, or physical attacks against Pomelo staff, patients, or offices.
• Low-impact findings with no demonstrated security impact, such as missing headers, clickjacking on pages with no sensitive actions, self-XSS, or software version disclosure.
• Reports generated only by automated scanners, without a confirmed issue.

How to report

Email security@pomelocare.com. If your report includes sensitive details, encrypt it with our PGP key (https://www.pomelocare.com/.well-known/pgp-key.txt) (fingerprint 259C 197F 12A3 8F07 01AF 5BA5 6D6B C9B8 B93F A2BB).

A good report includes:

• What the vulnerability is and where it is (URL, app screen, or API endpoint)
• Steps to reproduce it
• What an attacker could do with it
• Your name or handle, if you want credit
• The email addresses of any accounts you created
• The IP addresses you tested from, and the dates and times of testing, with time zone
• Any data you created, changed, or uploaded
• Whether you saw or accessed any data that wasn't yours

We don't offer a paid bug bounty or other compensation for reports.

Rules of engagement

Patient data is off limits. When you test:

• Add the header X-VDP-Researcher: <your email> to every HTTP request you send while testing, so we can tell your traffic apart from an actual attack.
• Use only accounts you created yourself. Use an email address with +vdp for any account you create, like you+vdp@example.com. If your email provider doesn't support plus addressing, put vdp somewhere in the address.
• Keep test data to a minimum and label it clearly, for example a name like “VDP Test”.
• Never access, change, or delete another person's account or data.
• Don’t request care or contact our care team from a test account.
• If you come across patient information or other personal data, stop immediately. Don't screenshot, download, save, copy, or share it. Tell us what you saw, delete anything you saved, and confirm in writing that you’ve deleted it.
• Do only what’s needed to confirm an issue. Once you’ve shown access is possible, don't go further, don’t use any exposed credentials, don’t pivot to other systems, and don’t keep a persistent foothold or install a backdoor.
• Don't do anything that could disrupt care, like flooding systems, spamming our care team, or sending messages to patients.
• Don’t disclose issues publicly before the timeline below.
• Follow all applicable laws.

What to expect from us

• We’ll acknowledge your report and follow up as we review it.
• We ask that you not disclose the issue publicly until 90 days after we receive your report, unless we agree in writing to an earlier date. If we need more time, we may ask you to wait longer. Never publicly disclose patient or personal data, credentials, or exploit details that would put people at risk.
• We won’t publicly identify you without your permission.

Prohibited activity

The following isn’t permitted: testing third-party or vendor systems; accessing, copying, keeping, or disclosing patient or other personal data, beyond brief accidental exposure that you stop and report right away; bypassing authentication, access controls, or encryption beyond what’s needed to confirm the issue; disrupting our services; pivoting to other systems or keeping persistent access; or asking for payment or anything else in exchange for vulnerability information. We treat that conduct as a security threat, not research, and may refer it to law enforcement.

This policy doesn’t bind third parties or government authorities, and it doesn’t limit our legal obligations, including our incident-response and notification duties.

If you have questions about this policy, email security@pomelocare.com.

We may update this policy at any time. The current version is always at this page.