MONOVELLA LTD, RC 9872896, 33 Ilupeju Street, Alabata Road, Camp, Abeokuta, Ogun State, Nigeria ("Monovella", "we"). Monovella is a connected-care platform that handles health, identity and payment data. We take reports of security vulnerabilities seriously and appreciate the effort of anyone who helps us find and fix them.
Report a vulnerability
Email [email protected]. Please do not report a vulnerability in a public place, such as social media or a public issue tracker.
Include:
- A description of the vulnerability and its potential impact.
- Steps to reproduce it, with a proof of concept if you have one.
- The page, address or component affected.
Please leave real patient, provider or payment information out of your report. If you came across any, tell us that you did, not what it was.
What to expect
- We acknowledge your report within 3 business days.
- We aim to share an initial assessment (whether it is valid, how severe it is, and the expected timeline) within 10 business days.
- We keep you informed while the issue is resolved and, with your permission, credit you once a fix has shipped.
Scope
In scope:
- The Monovella web app and API at monovella.com and its subdomains.
- Sign-in, authorization and session handling.
- How payment, clinical and identity data is handled.
Out of scope:
- Vulnerabilities that require physical access to a person's device.
- Denial-of-service testing against our live services.
- Social engineering of Monovella staff or users.
- Automated scanning that generates significant traffic against our live services without prior coordination. Email us first.
Please don't
- Access, change or copy data that isn't yours, beyond what is strictly necessary to demonstrate the vulnerability.
- Test with real patient, provider or payment data. Use your own test accounts and test data.
- Disclose a vulnerability publicly before we have had a reasonable chance to address it.