Vulnerability disclosure programLaunched Jun 2025 · Updated 2 months ago

Helios Health

Patient portal & clinical scheduling · helios.io

  • Accepting reports
  • VDP
  • Self-serve triage
  • Safe harbour
Your access
Open to every researcher

Sign in with a researcher account to file a report.

Submit a report Read the rules of engagement first
Reward
Recognition
Avg. response
3.1 days
Reports resolved
61
Bounties paid
—
Researchers
27

Overview

Helios Health runs a vulnerability disclosure program. There is no monetary bounty, but every valid report is credited on our hall of fame and handled with the urgency patient data deserves.

Program terms

Type
VDP
Rewards
Recognition only
Triage
Self-serve
Disclosure
Coordinated
Safe harbour
Offered
Status
Active

Response targets

First response
4 days
Triage decision
8 days
Resolution
60 days
Avg. first response
3.1 days

Scope

3 in · 4 out

In scope

In-scope assets
AssetTypeEnvironment
portal.helios.ioWebProduction
scheduling.helios.ioWebProduction
Patient records APIAPIProduction

Out of scope

Out-of-scope assets and activities
Asset or activityReason
helios.io (marketing)—
Third-party clinical integrations—
Denial-of-service / volumetric—
Any test touching real patient data—

Not rewarded

  • Denial of service / volumetric attacks
  • Self-XSS requiring victim-side paste
  • Missing security headers without demonstrated impact
  • Rate-limit or user enumeration without demonstrated impact
  • SPF / DKIM / DMARC configuration
  • Social engineering of staff or users
  • Best-practice reports with no security consequence

Rewards

Recognition
Rewards by severity
SeverityReward
CriticalRCE, auth bypass, mass data exposureRecognition
HighSSRF, stored XSS, privilege escalationRecognition
MediumIDOR, CSRF on sensitive actionsRecognition
LowReflected XSS, minor info disclosureRecognition
Final severity is set by Helios Health.

Rules of engagement

5 rules

  1. Test only assets listed in scope. Never access, modify or delete data that does not belong to your test account.

  2. Use your own test accounts. Stop immediately if you encounter another user's data and report it.

  3. No denial-of-service, automated scanning at scale, or social engineering of staff or users.

  4. Report each vulnerability once, with clear reproduction steps and evidence. Duplicates are closed against the earliest valid report.

  5. Keep findings confidential until Helios confirms a fix and agrees to disclosure. Good-faith research is authorized and will not be pursued legally.

Testing requirements

Use the test accounts issued to you. Tag automated traffic with a `X-Bug-Bounty: <your-handle>` header and keep request rates below 5/s.

Authorization

Testing is authorized only within the scope and rules on this page. Findings outside scope are not eligible and may not be protected under safe harbour.

Disclosure & safe harbour

Disclosure policy

Coordinated

Helios Health agrees a publication date with you once the issue is resolved.

Safe harbour

Offered

Helios Health will not pursue legal action against good-faith research within these rules.

Safe harbour statement
Helios will not pursue civil or criminal action, or send notice to law enforcement, for accidental or good-faith violations of this policy. We consider research conducted under it to be authorized, lawful and helpful to the overall security of the internet. You remain responsible for complying with any other applicable laws.

Recent activity

Latest 3
  • HighAppointment records readable across tenantsResolved · credited
  • MediumCSRF on care-team invitationResolved · credited
  • LowVerbose error leaks stack traceResolved · credited
Ready to report

Found something on Helios Health?

Submit a structured report with steps and evidence. Self-serve triage reviews it, and a valid finding is rewarded by severity.

Submit a report All programs