Drchrono Vulnerability Disclosure

generated: '2026-08-14'
method: probed
source: https://hackerone.com/drchrono
name: drchrono Vulnerability Disclosure
description: >-
  DrChrono runs a public bug bounty program on HackerOne, launched 2016-05-25, with a written policy,
  named scope covering the API, stated triage SLAs and PHI-weighted minimum rewards. It is public and
  offers bounties, but its submission state was DISABLED when probed on 2026-08-14 — the policy is
  readable, the intake is closed. DrChrono publishes no security.txt on any host, so there is no
  machine-readable path from an API host to this program.

program:
  found: true
  platform: HackerOne
  url: https://hackerone.com/drchrono
  handle: drchrono
  state: public_mode
  submission_state: disabled
  submission_note: >-
    HackerOne reports submission_state "disabled" for this program. The policy page resolves 200 and
    the program is publicly visible, but new reports cannot currently be filed through it.
  offers_bounties: true
  launched: '2016-05-25'
  probed: '2026-08-14'
  http_status: 200

response_targets:
  triage: 3-5 business days
  comment_or_resolve: 30-45 business days
  source: https://hackerone.com/drchrono

scope:
  web:
    - {asset: 'https://www.drchrono.com', description: doctor platform}
    - {asset: 'https://www.onpatient.com', description: patient portal}
    - {asset: 'https://drchrono.com/api/', description: drchrono API}
  ios:
    - drchrono iPad EHR
    - drchrono EMR
    - drchrono Patient Check-In
    - onpatient
    - ICD-10 HCPCS ICD-9
  api_access: >-
    Researchers must email api@drchrono.com with their drchrono and HackerOne usernames to be granted
    API access, then create an API application at https://drchrono.com/api-management.

out_of_scope:
  - drchrono Android app (a webview of the site, no longer supported)
  - Issues in software not under drchrono control
  - Provisioning errors
  - Violation of vendor licenses or restrictions
  - Social engineering against drchrono or medical practice staff
  - Spam
  - Phishing
  - Denial-of-service attacks, unless part of another attack chain
  - Reports drchrono cannot reproduce

rewards:
  currency: USD
  minimum_general: 50
  minimum_api: 100
  minimum_phi_exposure_outside_account: 200
  minimum_large_scale_phi_exposure: 500
  maximum: none stated
  note: >-
    The reward schedule is explicitly PHI-weighted — the highest published minimums attach to
    protected health information leaving the owner's account, which is the correct risk model for an
    EHR and is unusual enough to be worth recording.

security_txt:
  found: false
  probed:
    - {url: 'https://app.drchrono.com/.well-known/security.txt', status: 404}
    - {url: 'https://www.drchrono.com/.well-known/security.txt', status: 404}
    - {url: 'https://drchrono-fhirpresentation.everhealthsoftware.com/.well-known/security.txt', status: 404}
    - {url: 'https://www.evercommerce.com/.well-known/security.txt', status: 404}
    - {url: 'https://drchrono-fhir.everhealthsoftware.com/.well-known/security.txt', status: 200, rejected: true, reason: 'HTML application shell, not an RFC 9116 document; this host answers 200 with the same body for arbitrary /.well-known/* paths.'}
  gap: >-
    A researcher who finds a flaw while calling app.drchrono.com has no machine-readable route to the
    HackerOne program. Publishing an RFC 9116 security.txt with a Policy field pointing at
    https://hackerone.com/drchrono would close this with one file.

other_platforms_probed:
  - {url: 'https://bugcrowd.com/drchrono', status: 404}
  - {url: 'https://hackerone.com/evercommerce', status: 404}
  - {url: 'https://bugcrowd.com/evercommerce', status: 404}

contacts:
  api_security: api@drchrono.com
  general_support: support@drchrono.com