> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medisao/report-a-vulnerability.md).

# Report a vulnerability

If you've found a security vulnerability in a medical device, report it confidentially through MedISAO's coordinated vulnerability disclosure (CVD) program. In CVD, the person who finds a vulnerability reports it privately so the manufacturer can fix it before details are made public. MedISAO receives your report, works to get it to the affected manufacturer, and gives you a private link to follow its progress.

This page is for security researchers, clinicians, hospital staff, and anyone else reporting a vulnerability.

## Before you begin

* Have the manufacturer's name and the affected product and version ready.
* Write up the vulnerability: steps to reproduce, potential impact, and anything else a manufacturer would need to confirm it.
* If you know it, have the CVSS base score (Common Vulnerability Scoring System, a 0.0 to 10.0 severity scale). It's optional.

## Where to submit

* **From inside the app:** If you're signed in to a workspace with MedISAO, select **Report Vulnerability** in the sidebar.
* **From a manufacturer's own disclosure portal:** Some manufacturers publish a branded disclosure page with their own logo and colors. It uses the same form, and submissions go directly to that manufacturer.

## Read the guidelines

The **Coordinated Vulnerability Disclosure** form begins with what to expect.

**What you can expect from us**

* Acknowledgement within 5 business days
* Best efforts to contact the affected manufacturer
* Possible follow-up contact for additional details
* Updates on the status of your report when available

**What we expect of you**

* Avoid clinical or patient testing of vulnerabilities
* Protect patient privacy and sensitive data
* Comply with all applicable laws and regulations
* Provide accurate and complete information

For questions before you submit, use the contact email shown on the form. On MedISAO's own form, that's <confidential@medisao.com>. A manufacturer's portal may show its own address instead.

## Submit the disclosure form

1. Under **Disclosure Form**, fill in:

   | Field                                                | Required | What to enter                                                                                        |
   | ---------------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------- |
   | **Manufacturer**                                     | Yes      | The device maker, for example *Acme Medical Devices*. Up to 512 characters.                          |
   | **Affected Products**                                | Yes      | The product and version, for example *Model XYZ Infusion Pump, Version 2.1*. Up to 1,024 characters. |
   | **CVSS Score (optional)**                            | No       | A base score from 0.0 to 10.0, if you know it.                                                       |
   | **Has this vulnerability resulted in any injuries?** | No       | Select this if the vulnerability has harmed anyone.                                                  |
   | **Vulnerability Description**                        | Yes      | Steps to reproduce, potential impact, and other relevant details.                                    |
   | **Your Email**                                       | Yes      | The address MedISAO or the manufacturer uses to follow up with you.                                  |
2. Select **Submit Disclosure**.
3. If anything needs fixing, the field is highlighted with a message and **Please correct the errors above** appears. Correct it and submit again.

When the submission succeeds, you see **Thank You for Your Submission**.

## Save your tracking link

The confirmation page shows a **Track Your Submission** box with a private link to your report's status page.

1. Select **Copy** and store the link somewhere safe. Anyone with the link can see your report's status, so treat it like a password.
2. Note the expiry date shown under the link (**This link expires on...**).

{% hint style="warning" %}
Copy the tracking link before you leave the confirmation page. You need it to see your report's status.
{% endhint %}

## Check your report's status

Open your tracking link. You don't need to sign in. The **Disclosure Status** page shows:

* **Severity and status badges:** The severity and CVSS score, and where your report is in the process.
* **Details:** **Manufacturer**, **Affected Products**, and the date it was **Submitted**.
* **Activity History:** Each change to your report, newest first, with who made it and when. This includes status changes, TLP level changes, assignment to a manufacturer, and comments left for you.
* **Access Expiration:** The date your access to the page ends.

Your report moves through these statuses:

| Status                        | Meaning                                       |
| ----------------------------- | --------------------------------------------- |
| **Intake**                    | Received and being reviewed.                  |
| **Submitted to Manufacturer** | Passed to the affected manufacturer.          |
| **Rejected**                  | Not accepted as a valid vulnerability report. |
| **Fixed**                     | The manufacturer has fixed the vulnerability. |
| **Handled**                   | The report has been dealt with and closed.    |

The history also records changes to the report's TLP level. TLP (Traffic Light Protocol) says how widely the report's details may be shared. New reports start at TLP:RED, which means restricted to named recipients.

If your link has expired or the page shows **Access Error**, email <confidential@medisao.com>. The team handling your report can extend your access.

## Next steps

* [Manage coordinated vulnerability disclosures](/medisao/manage-coordinated-vulnerability-disclosures.md): see what manufacturers do with your report once they receive it.