Metriport · Vulnerability Disclosure

Metriport Vulnerability Disclosure

Vulnerability disclosure

Metriport publishes a vulnerability disclosure policy, but only in the open-source repository — there is no security.txt on any host (every /.well-known/security.txt probe returned 403 on the API hosts and 404 on the marketing and documentation hosts, see well-known/metriport-well-known.yml). The policy is short and covers both the source code and the hosted API.

Metriport runs a coordinated vulnerability disclosure program on Hackerone.

HealthcareMedical RecordsFHIRHealth DataWearablesOpen-Source
Program: Hackerone

Disclosure Policy

Security Contact

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-08-14'
method: searched
source: https://github.com/metriport/metriport/blob/develop/SECURITY.md
description: >-
  Metriport publishes a vulnerability disclosure policy, but only in the
  open-source repository — there is no security.txt on any host (every
  /.well-known/security.txt probe returned 403 on the API hosts and 404 on the
  marketing and documentation hosts, see well-known/metriport-well-known.yml).
  The policy is short and covers both the source code and the hosted API.
published: true
policy_url: https://github.com/metriport/metriport/blob/develop/SECURITY.md
raw_url: https://raw.githubusercontent.com/metriport/metriport/develop/SECURITY.md
http_status: 200
checked: '2026-08-14'
scope: The Metriport API and/or source code.
channels:
  - type: github-private-vulnerability-reporting
    url: https://github.com/metriport/metriport/security
    preferred: true
  - type: email
    address: support@metriport.com
preferred_languages: [en]
commitments:
  - We will investigate all legitimate reports.
  - We will do our best to quickly fix the problem.
missing:
  security_txt: >-
    SECURITY.md embeds a security.txt-shaped block (Contact, Preferred-Languages,
    Policy) in a fenced code block, but it is never served at
    /.well-known/security.txt on any host. The content exists; the RFC 9116
    discovery path does not.
  bug_bounty: >-
    No bug bounty programme. No HackerOne, Bugcrowd or Intigriti presence was
    found.
  safe_harbor: No safe-harbor or legal-protection language is published.
  disclosure_timeline: No acknowledgement window, remediation SLA or coordinated-disclosure timeline is stated.
  hall_of_fame: None.
  pgp_key: None.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/metriport-vulnerability-disclosure"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.