Reporting a security concern

This project shares a disclosure path with the rest of MOBLUEHQ: security@mobluehq.com, published at /.well-known/security.txt, with the disclosure policy at /trust. That path covers the open spine and the commercial suite alike — there is no separate channel for this section yet.

A concern specific to a jurisdiction pack, the record core, or the verifier is welcome through the same address. Please do not attach or include any real patient, member, claimant, or clinician data in a report — see the fixtures rule, which applies here too.

Publishing source code does not weaken a well-built system, and no signing key is ever kept in code. A short list of things must be true first:

• Publish from a new, clean repository — never the internal one — and run a secret scan over what's published.
• The care-team access gap is closed for every record type — enforced for all 15 resource types today. Real patient data still requires the clinic's own explicit go-live sign-off, recorded only once the rest of the go-live checklist is done.
• Test and demo keys must fail closed outside demo mode, with a test that proves it.
• A vulnerability-reporting address and a security policy, required review of every outside contribution, and signed releases.
• The required U.S. export-control notification for published encryption code.