Cadence Health

Program overview

Cadence Health runs the clinical record platform behind 412 independent practices across fourteen states. Three surfaces matter: the patient portal, the charting and scheduling workspace clinicians sit in all day, and the FHIR R4 gateway that exchanges records with partner systems. All three rest on protected health information, and that one fact is where every rule below comes from.

We have paid since July 2020. Since then: 1,147 reports resolved, 283 researchers thanked, 1,072,904 USD paid, first response inside six hours on average and inside a day on a weekend. We are also the program on this directory most likely to accept a finding and still have a long conversation about how it was found. Read the next section before you touch anything. It is not boilerplate and it is not negotiable.

Testing rules and expectations

February 2022. A researcher found an object reference flaw on the document endpoint and, to establish the pattern, incremented the identifier four thousand one hundred times. Most of what came back was real. We paid the Critical band, because the bug was real and the report was honest. We also spent four months on notification, and two practices left. Everything in this section was written that spring.

Synthetic records only. Onboarding issues you a sandbox tenant seeded from a generated population and reseeded every Sunday. Work there. Production tenants belong to clinics and to the people sitting in their waiting rooms.

The hard stop. If you reach anything that could plausibly be real (a name beside a diagnosis, a date of birth, a member number, a scanned referral), stop at that instant. Do not increment the identifier to confirm the pattern. That single step is what turns a bug into a breach, and it is the only rule here whose violation has ever cost someone a bounty. End the session and tell us within the hour. The shape of the exposure is enough; we confirm the rest from our own logs.

No retention. Nothing retrieved from our systems goes to disk, to cloud sync, to a notes application, to a paste service, to a chat client, to a language model, or to a co-researcher. Minimum proof is the smallest artefact that carries the finding: one identifier, one redacted field, one response header. Five hundred rows prove nothing that one row does not.

Volume and technique. Five requests per second per host. No scanner against the gateway at all, a rule from August 2023 after a weekend scan left two clinics waiting on chart loads. A clinician who cannot open a chart is a patient safety event, not an availability metric. No social engineering of clinic staff, no phishing, no physical attempts.

Proving write access

If you find a way to write, do not prove it by causing damage. Prove it with the smallest change that can be attributed to you and undone in the same minute.

• One or two punctuation characters. Delete a full stop, add a comma. Nothing longer, nothing visible, no payload, no changed number or amount.
• Only on a record you created yourself. Never another user's record, never site content, never anything the public can see.
• Revert within sixty seconds, in the same run, without being asked.
• Capture four states: before, after the change, after the revert, and an independent re-read confirming the revert held.
• If it cannot be reverted, do not change it. Report the write primitive and stop. A row count and a column list already prove database access.

Every request must carry headers that let us separate your traffic from a real attack in our logs:

X-Bug-Bounty:        cadence-health
X-Research-Account:  <the account you submit the report under>
X-Authorisation-Ref: <engagement or report reference>
X-Request-Id:        <unique per request>
User-Agent:          sentinel-research/<handle> (+<this page>)

scripts/proof_of_write.py performs exactly this sequence, refuses any host outside the scope above, refuses a diff longer than two characters, always attempts the revert, and writes a timestamped evidence file. Run it without --execute first, then attach the evidence to your report.

Safe harbor

Research inside this policy is authorised research. We will not bring civil action and we will not refer you under computer misuse or health privacy statutes. If anyone else challenges testing that stayed within these rules, we put our authorisation in writing and send it to them ourselves.

Good faith means: you worked in your assigned sandbox, you stopped at the first plausibly real record, you kept the minimum, you did not slow anything down, and you reported promptly and only to us.

Authorisation ends if you reach a production tenant that is not yours, continue past the hard stop, retain or transmit or publish patient information, modify or delete a record, make payment a condition of disclosure, or route the finding to anyone outside Cadence Health before the window closes. If it is voided we tell you and we explain why. We have done that twice and we did not grant it back either time.

Reward decisions

CVSS v3.1 is where scoring starts, not where it ends. A medium-scoring flaw that yields one field from one patient record outranks a high-scoring flaw on a surface with no clinical content. Clinical data is weighted above account metadata at identical technical severity, and a finding on the gateway is weighted above the same finding on the portal because the gateway speaks for several practices at once.

Where two reports collide, the one that established impact first takes the award; a vague earlier note blocks nothing. A chain earns a single award scored on what it achieves end to end, plus up to 30% when it exposes a control failure we had not modelled. A working patch adds 10%.

Disclosure policy

Ninety days from triage confirmation. We extend only when a fix requires a coordinated release with a partner health system, and never by more than a further 45 days. The target date goes to you in writing on the day we ask.

Publish when we ship or when the window closes, whichever is first. Remove every record identifier, tenant name, practice name and hostname, and every screenshot showing a field from a record even where you are certain the record was synthetic. Give us the draft a week before you publish. We read it for redaction and for nothing else.

Report quality

• One issue per report. A chain belongs together; unrelated bugs do not.
• Exact endpoint, method and parameter, with the sandbox tenant identifier you used.
• Numbered steps that work from a clean session, with nothing skipped as obvious.
• Impact in clinical terms: whose data, how much of it, what an attacker does next.
• Minimum proof, redacted, inline. No archives, no external links, no video panning across a list of records.
• Your testing window, start to finish, in UTC, so we can pull the matching request logs.