Waves Security and Vulnerability Disclosure
People use Waves during labor, and clinicians use it to follow their clients. Keeping that information safe matters more to us than anything else we build. If you have found a security problem, thank you. This page explains how to tell us and what you can expect.
How to report a problem
Email security@theorian.com with "Security report" in the subject. Please include:
- What the problem is and what someone could do with it.
- The steps to reproduce it, and any proof-of-concept or screenshots.
- How to reach you.
Please do not include anyone's health information or other personal data in your report.
What you can expect from us
- A reply from a real person within 3 business days.
- Our assessment, and the fix we plan, within 10 business days.
- Updates until it is resolved, and credit for the find if you would like it.
We do not run a paid bug bounty.
What is covered
- The Waves apps for iPhone, Apple Watch and Android.
- waves.theorian.com and the services behind the app.
Not covered: services run by other companies (report those to them), social engineering of our staff or users, physical attacks, denial-of-service, spam, and findings with no demonstrated security impact.
Ground rules
- Use only your own devices and test data. Never view, change or delete another person's data. If you come across any, stop and tell us.
- Do not degrade the service for others, and do no more than is needed to show the problem.
- Give us a reasonable time to fix it before telling anyone else. We ask for 90 days, and we will agree a date with you.
Safe harbor
If you act in good faith and follow this page, we will treat your research as authorized, we will not take legal action against you for it, and we will say so if anyone else does.
If something does go wrong
Theorian's owner leads the response to any security incident. We investigate, contain it, and tell the people affected without unreasonable delay, in plain language, with what happened and what to do. A practice that has a Business Associate Agreement with us is told within the time that agreement sets.
Contact
Theorian LLC, Honolulu, Hawai‘i, USA. security@theorian.com