Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Insight Health

Vulnerability disclosure program on Self-hosted insighthealth.ai

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
5
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Partial safe harbor
Some legal protection; read the terms.
Replies within 3 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No Insight Health does not currently operate a paid bug bounty program.
Response
Within 3 days Acknowledgment within 3 business days. We will confirm receipt of your report.
Safe harbor
Partial Act in good faith and within the law.
Hall of fame
Yes Credit (optional). If you'd like, we will acknowledge your contribution on this page once the issue is resolved.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

5 assets you may test.

Domains 4

  • app.insighthealth.ai
  • auth.insighthealth.ai
  • insighthealth.ai
  • nsighthealth.ai

APIs 1

  • api.insighthealth.ai

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Insight Health's policy. "We" in these lines means the program, not this site.

While testing

  • Do not access, modify, or delete data belonging to other users.
  • Do not disrupt our services or degrade the experience for our users.
  • Do not test against production patient data.
  • Any interaction with real patient data is strictly prohibited.
  • Do not publicly disclose a vulnerability before we've had a reasonable opportunity to address it.
  • Act in good faith and within the law.

Not accepted

  • Reports from automated scanners without manual verification or demonstrated impact.
  • Email auto-linking behavior (e.g., email clients rendering user-provided text as clickable hyperlinks).
  • Social engineering, phishing, or physical attacks against Insight Health employees or users.
  • Denial-of-service (DoS/DDoS) attacks or volumetric testing.
  • Content injection without demonstrated security impact (e.g., entering text into input fields that is later displayed).
  • Missing security headers that do not lead to a demonstrated exploit.
  • Self-XSS (where the victim must paste code into their own browser console).
  • Rate limiting or brute-force issues on non-authentication endpoints.
  • Vulnerabilities in third-party services, libraries, or upstream providers unless they directly compromise Insight Health systems.
  • Reports that require unlikely or impractical user interaction.
  • SPF/DKIM/DMARC configuration suggestions without demonstrated spoofing impact.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope

    − Web application, − Application platform, − Authentication service

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.