Please report suspected vulnerabilities privately rather than testing against customer data or disrupting the service. Include the affected URL or component, a concise description, safe reproduction steps and your preferred contact details.
Send reports to security@1uthealthltd.com. The machine-readable reporting address is also published at /.well-known/security.txt.
Current safeguards
- Clerk authenticates account identity; account API reads are scoped to the authenticated subject’s local customer id.
- Guest order lookup requires a reference and a high-entropy access code, with rate limiting and no token logging.
- Stripe handles card entry; application order records do not contain card details.
- Exports are private, authenticated, token-bound and expire after a short period.
- Application logs redact authorization and cookie headers.