> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medcrypt-documentation/medisao/report-a-vulnerability.md). # Report a vulnerability If you've found a security vulnerability in a medical device, report it confidentially through MedISAO's coordinated vulnerability disclosure (CVD) program. In CVD, the person who finds a vulnerability reports it privately so the manufacturer can fix it before details are made public. MedISAO receives your report, works to get it to the affected manufacturer, and gives you a private link to follow its progress. This page is for security researchers, clinicians, hospital staff, and anyone else reporting a vulnerability. ## Before you begin * Have the manufacturer's name and the affected product and version ready. * Write up the vulnerability: steps to reproduce, potential impact, and anything else a manufacturer would need to confirm it. * If you know it, have the CVSS base score (Common Vulnerability Scoring System, a 0.0 to 10.0 severity scale). It's optional. ## Where to submit * **From inside the app:** If you're signed in to a workspace with MedISAO, select **Report Vulnerability** in the sidebar. * **From a manufacturer's own disclosure portal:** Some manufacturers publish a branded disclosure page with their own logo and colors. It uses the same form, and submissions go directly to that manufacturer. ## Read the guidelines The **Coordinated Vulnerability Disclosure** form begins with what to expect. **What you can expect from us** * Acknowledgement within 5 business days * Best efforts to contact the affected manufacturer * Possible follow-up contact for additional details * Updates on the status of your report when available **What we expect of you** * Avoid clinical or patient testing of vulnerabilities * Protect patient privacy and sensitive data * Comply with all applicable laws and regulations * Provide accurate and complete information For questions before you submit, use the contact email shown on the form. On MedISAO's own form, that's . A manufacturer's portal may show its own address instead. ## Submit the disclosure form 1. Under **Disclosure Form**, fill in: | Field | Required | What to enter | | ---------------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------- | | **Manufacturer** | Yes | The device maker, for example *Acme Medical Devices*. Up to 512 characters. | | **Affected Products** | Yes | The product and version, for example *Model XYZ Infusion Pump, Version 2.1*. Up to 1,024 characters. | | **CVSS Score (optional)** | No | A base score from 0.0 to 10.0, if you know it. | | **Has this vulnerability resulted in any injuries?** | No | Select this if the vulnerability has harmed anyone. | | **Vulnerability Description** | Yes | Steps to reproduce, potential impact, and other relevant details. | | **Your Email** | Yes | The address MedISAO or the manufacturer uses to follow up with you. | 2. Select **Submit Disclosure**. 3. If anything needs fixing, the field is highlighted with a message and **Please correct the errors above** appears. Correct it and submit again. When the submission succeeds, you see **Thank You for Your Submission**. ## Save your tracking link The confirmation page shows a **Track Your Submission** box with a private link to your report's status page. 1. Select **Copy** and store the link somewhere safe. Anyone with the link can see your report's status, so treat it like a password. 2. Note the expiry date shown under the link (**This link expires on...**). {% hint style="warning" %} Copy the tracking link before you leave the confirmation page. You need it to see your report's status. {% endhint %} ## Check your report's status Open your tracking link. You don't need to sign in. The **Disclosure Status** page shows: * **Severity and status badges:** The severity and CVSS score, and where your report is in the process. * **Details:** **Manufacturer**, **Affected Products**, and the date it was **Submitted**. * **Activity History:** Each change to your report, newest first, with who made it and when. This includes status changes, TLP level changes, assignment to a manufacturer, and comments left for you. * **Access Expiration:** The date your access to the page ends. Your report moves through these statuses: | Status | Meaning | | ----------------------------- | --------------------------------------------- | | **Intake** | Received and being reviewed. | | **Submitted to Manufacturer** | Passed to the affected manufacturer. | | **Rejected** | Not accepted as a valid vulnerability report. | | **Fixed** | The manufacturer has fixed the vulnerability. | | **Handled** | The report has been dealt with and closed. | The history also records changes to the report's TLP level. TLP (Traffic Light Protocol) says how widely the report's details may be shared. New reports start at TLP:RED, which means restricted to named recipients. If your link has expired or the page shows **Access Error**, email . The team handling your report can extend your access. ## Next steps * [Manage coordinated vulnerability disclosures](/medcrypt-documentation/medisao/manage-coordinated-vulnerability-disclosures.md): see what manufacturers do with your report once they receive it. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.medcrypt.com/medcrypt-documentation/medisao/report-a-vulnerability.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.