# THOS, the Tanzania Health Operating System
# Security disclosure policy, per RFC 9116.

Contact: mailto:support@laetoli.tz
Expires: 2027-08-30T00:00:00.000Z
Preferred-Languages: en, sw
Canonical: https://tibaecosystem.co.tz/.well-known/security.txt
Policy: https://tibaecosystem.co.tz/governance/security

# What we ask
#
# Tell us what you found and how to reproduce it. Give us 90 days before
# publishing. Do not access, alter or retain another person's health record:
# if a defect exposes one, stop there, and say so in the report rather than
# demonstrating the extent.
#
# What you can expect
#
# An acknowledgement within five working days, an assessment within thirty,
# and credit in the disclosure record unless you ask us not to.
#
# What we cannot offer
#
# There is no bounty. This is a private company building a system that no
# ministry has adopted and that serves no patients yet. No independent
# penetration test has ever been performed against it.