LinkInCare
Sign inJoin free

Version October 16, 2026

Vulnerability Disclosure Policy

Last updated: October 16, 2026

LinkInCare holds sensitive information about healthcare workers. If you find a security vulnerability in LinkInCare, we want to hear about it, and we want you to be safe when you tell us. This policy explains what is in scope, how to report, what we promise, and what we ask of you. It is modelled on the disclose.io open-source core terms.

In scope:

  • linkincare.com and linkin.care, including app., advertiser., admin. and api. subdomains

  • The LinkInCare CareMember app, advertiser dashboard and installable web app

  • Our email and text-message flows

Out of scope:

  • Services run by our providers (AWS, Stripe, Cloudflare, YouTube, TikTok, Instagram); report those to the provider

  • Findings that need physical access to a device, social engineering of our staff or users, or a stolen account

  • Denial of service, rate-limit exhaustion, spam and bulk account creation

  • Reports from automated scanners without a demonstrated impact

  • Missing best-practice headers or configuration without a demonstrated impact

Email security@linkincare.com with the subject "Security". Tell us what you found, where, how to reproduce it, and what impact you believe it has. You may report anonymously. We aim to confirm receipt within three business days, keep you informed, and tell you when the issue is fixed. We publish a security.txt file at https://linkincare.com/.well-known/security.txt with this contact.

If you comply with this policy in good faith, we will:

  • Not pursue or support legal action against you for your research, and consider it authorised under the Computer Fraud and Abuse Act and similar laws, and exempt from the anti-circumvention rules of the DMCA and from the restrictions in our Terms of Use and Acceptable Use Policy that would otherwise prohibit it.

  • Work with you to understand and fix the issue quickly.

  • Credit you publicly if you want, once the issue is fixed.

If a third party starts legal action against you for activity that complied with this policy, we will make it known that you acted under it. This authorisation is limited to LinkInCare's own systems and to activity that complies with this policy; it does not bind third parties such as our hosting and service providers, and we cannot authorise testing of their systems. We decide in good faith whether activity complied with this policy, and the safe harbor does not apply to anyone who acts in bad faith, exceeds the scope in Section 1, or breaks the rules in Section 4. We do not run a paid bug bounty program today, and nothing in this policy promises any reward or credit.

  • Test only against accounts you own or have permission to use. Create your own test accounts; do not touch other people's data.

  • Stop as soon as you find a vulnerability that exposes personal information, and report it right away. Do not download, keep, share or use any data you reach beyond what is needed to show the issue.

  • Do not degrade the service, destroy data, or run automated tools at a volume that affects other users.

  • Do not use social engineering, phishing, physical attacks or attacks on our providers.

  • Give us a reasonable time to fix the issue before you talk about it publicly. We aim to fix critical issues within 30 days and others within 90 days, and we will try to agree a disclosure date with you; these are targets, not commitments.

We treat your report as confidential. We use the details only to understand and fix the issue and to improve our security. Your contact information is kept for the life of the report plus one year and is not shared outside the people working on it.

Contact: mailto:security@linkincare.com
Expires: 2027-10-15T00:00:00.000Z
Preferred-Languages: en, es
Canonical: https://linkincare.com/.well-known/security.txt
Policy: https://linkincare.com/security-disclosure