Insight Health Responsible Disclosure Program

[adityaax]

Company

Insight Health

Program URL

https://www.insighthealth.ai/security

Contact

mailto:security@insighthealth.ai

Rewards

• *bounty
• *recognition
• *swag

Program type

vdp

Status

active

Description

If you believe you've found a security vulnerability in an Insight Health product or service, we want to hear from you. Please email your report to security@insighthealth.ai

Domains

nsighthealth.ai
auth.insighthealth.ai
app.insighthealth.ai
api.insighthealth.ai

Structured scope

nsighthealth.ai	| Web application
auth.insighthealth.ai |	Authentication service
app.insighthealth.ai | Application platform
api.insighthealth.ai |	API

Out of scope

Reports from automated scanners without manual verification or demonstrated impact.
Email auto-linking behavior (e.g., email clients rendering user-provided text as clickable hyperlinks).
Social engineering, phishing, or physical attacks against Insight Health employees or users.
Denial-of-service (DoS/DDoS) attacks or volumetric testing.
Content injection without demonstrated security impact (e.g., entering text into input fields that is later displayed).
Missing security headers that do not lead to a demonstrated exploit.
Self-XSS (where the victim must paste code into their own browser console).
Rate limiting or brute-force issues on non-authentication endpoints.
Vulnerabilities in third-party services, libraries, or upstream providers unless they directly compromise Insight Health systems.
Reports that require unlikely or impractical user interaction.
SPF/DKIM/DMARC configuration suggestions without demonstrated spoofing impact.

Minimum payout

No response

Maximum payout

No response

Currency

No response

Payout - critical

No response

Payout - high

No response

Payout - medium

No response

Payout - low

No response

Testing policy URL

No response

Excluded methods

• dos
• social_engineering
• phishing
• physical_access
• automated_scanning

Requires account

None

Safe harbor

None

Allows disclosure

None

Disclosure timeline days

No response

Response SLA days

3

Legal terms URL

No response

Hall of fame URL

No response

Swag details

No response

Reporting URL

No response

PGP key URL

No response

Preferred languages

English

Standards

Confirmation

• I confirm the information is accurate and I have included only publicly documented program details.

[liss-bot]

Hey @adityaax, thank you for your submission!
I've created a PR at #90 to get this merged in 😊