Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in dentisti.pro, please report it to us responsibly:

• Email: security@dentisti.pro
• PGP: Available on request
• Response time: We aim to acknowledge reports within 48 hours and provide a resolution timeline within 5 business days.

Please include a detailed description of the issue, steps to reproduce, and any potential impact assessment. Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue.

Our Commitment

• We will not take legal action against researchers who act in good faith and follow this policy.
• We will work with you to understand and resolve the issue promptly.
• With your permission, we will publicly acknowledge your contribution on our Hall of Fame.
• We will not disclose your identity without your explicit consent.

Out of Scope

• Social engineering attacks against our staff or users
• Physical security attacks
• Denial-of-service attacks that degrade service availability
• Issues in third-party services or dependencies outside our direct control
• Reports of missing security headers on non-sensitive static assets without demonstrated impact

Security Measures

dentisti.pro implements the following security controls:

• All data is encrypted at rest and in transit (TLS 1.2+)
• Patient health information (PHI) uses AES-256-GCM encryption with key separation
• Role-based access control with session fingerprinting
• CSRF protection on all state-changing operations
• Brute-force protection and rate limiting
• Activity logging with HMAC integrity verification
• Regular automated backups with independent encryption keys
• HIPAA/GDPR compliance monitoring and breach detection