In scope
Innovaccer-owned web assets
*.innovaccer.com
Security vulnerabilities on Innovaccer-owned websites and applications under this domain that demonstrate a meaningful impact to confidentiality, integrity, or availability.
Trust Center / Responsible disclosure
Vulnerability reporting
If you believe you’ve found a security vulnerability in an Innovaccer-owned website or application, tell us. We investigate legitimate reports and work to address validated issues as quickly as practicable.
This is a responsible disclosure program, not a paid bug bounty. Eligible researchers may receive a Hall of Fame certificate at Innovaccer’s discretion.
01 / Scope
Know where to test
Only test assets that are explicitly included below. If ownership is unclear, contact us before testing.
Out of scope
- Third-party services or software not controlled by Innovaccer
- Denial of service, stress testing, or high-volume automated scanning
- Social engineering, phishing, spam, or physical security testing
- Issues affecting only obsolete or unsupported browsers and platforms
- Best-practice observations without a demonstrable security impact
Stop at proof. If testing gives you access to sensitive data, privileged accounts, or production systems, do not continue. Record only the minimum evidence necessary and report it immediately.
02 / Eligible findings
What we want to hear about
Examples are indicative, not exhaustive. A valid report must show a reproducible issue and a meaningful security impact.
Access & identity
Authentication bypass, account takeover, authorization failures, privilege escalation, or session hijacking.
Injection & execution
SQL or command injection, remote code execution, local or remote file inclusion, and directory traversal with impact.
Data exposure
Unauthorized access to sensitive information, insecure direct object references, or material cross-origin data exposure.
Application security
Cross-site scripting, impactful CSRF, server-side request forgery, payment manipulation, and replay attacks.
Other material vulnerabilities
Vulnerable dependencies with a working exploit, memory or buffer overflow issues, and other reproducible vulnerabilities with significant security impact.
Security misconfiguration
Exposed cloud storage, insecure defaults, overly permissive services, diagnostic data exposure, or configuration flaws that weaken tenant isolation.
AI & LLM security
Report security weaknesses that let an attacker manipulate, overreach, or expose an AI system.
Prompt injection
Inputs that override intended instructions or cause unsafe model behavior.
Excessive agency
AI actions that exceed appropriate permissions, scope, or human oversight.
System prompt leakage
Exposure of confidential system instructions, policies, or implementation details.
Common reports that usually do not qualify
- Missing security headers without exploitability
- Clickjacking without material impact
- Missing CSRF tokens without a working attack
- Self-XSS or attacks requiring self-execution
- Dependency version reports without a working exploit
- User enumeration without demonstrated impact
- Rate-limiting observations or brute-force testing
- TLS configuration observations without exploitability
- Open redirects without a chained security impact
- Scanner-only findings that have not been manually verified
03 / Testing rules
Research safely and in good faith
Keep testing proportionate, private, and limited to accounts and data you are authorized to use.
Use your own test accounts
Do not access, alter, download, retain, or disclose another person’s data. Avoid privacy violations and disruption to users or services.
Do not disrupt services
No DoS/DDoS, stress testing, spam, brute force, excessive traffic, malware, destructive actions, or automated scanning that may affect availability.
Minimize and protect evidence
Collect only what is needed to demonstrate the issue. Do not include PHI, PII, credentials, or unrelated customer data. Delete report artifacts after closure.
Keep the report confidential
Allow us reasonable time to investigate and remediate before any disclosure. Do not exploit a vulnerability for personal or third-party benefit.
Collaborate on validation
Provide clear reproduction steps, answer reasonable follow-up questions, and, when requested, help verify that a corrective measure is effective.
04 / What happens next
A clear path from report to resolution
- 01
Submit
Send a concise, reproducible report through the official channel below.
- 02
Acknowledge
We aim to provide a first response within one business day.
- 03
Triage
We aim to complete initial triage within three business days and may request more detail.
- 04
Remediate
Validated issues are prioritized based on severity, impact, and affected scope.
- 05
Close
We’ll keep you informed when practical and may invite you to validate the fix.
Ready to report?
Send us the signal.
We’ll take it from here.
Include the affected asset, vulnerability type, impact, reproducible steps, and the minimum evidence required to validate the issue.
Reports are routed privately to Innovaccer’s security team. Do not include PHI, PII, credentials, or unrelated production data.
A strong report includes
- 01Affected URL, asset, or product
- 02Vulnerability type and potential impact
- 03Step-by-step reproduction instructions
- 04Sanitized proof of concept or screenshots
- 05Your preferred contact details
Good-faith research
Our approach to responsible reports
Innovaccer will evaluate reports submitted in good faith and consistent with this policy. If you encounter sensitive data or exceed the intended scope accidentally, stop testing, notify us promptly, avoid further access, and cooperate with our investigation. This policy does not authorize access to third-party systems, provide immunity from applicable law, or waive Innovaccer’s legal rights.