SECURITY.md

Security Policy

Reporting Vulnerabilities

Please report security issues to: [email protected] PGP Key: [Link to public key]

Response SLA

• Acknowledgement: 24 hours
• Patch timeline: 72 hours (critical), 7 days (high)
• Public disclosure: 14 days after patch

Encryption Standards

• Data at Rest: AES-256
• Data in Transit: TLS 1.3+
• Secrets: Vault-transit encrypted

Access Controls

• RBAC Matrix:

  Patient:
    - read_own_records
    - manage_appointments
  
  Doctor:
    - read_patient_records
    - update_availability
  
  Admin:
    - manage_users
    - audit_logs

Audit Processes

1. Monthly penetration tests
2. Quarterly security training
3. Annual HIPAA compliance audit
4. Real-time intrusion detection