Responsible Disclosure

Last updated 6 October 2026. This page is the policy referenced by /.well-known/security.txt.

1. Report a vulnerability

Email help.myomed@myomedprep.org with the subject "Security report". If you need to send something sensitive, say so and we will arrange an encrypted channel. Do not open a public issue and do not test against another learner's account or data.

2. What to include

• The affected product and URL (myomedprep.org, NexGen Mastery, RadMatrix, MyoMed Rescue, Foundations).
• Steps to reproduce, with the smallest request or input that triggers it.
• The impact you believe it has, and any proof-of-concept (redact real personal data).
• How you would like to be credited, or that you prefer to remain anonymous.

3. Our commitments

• We acknowledge every report within five business days.
• We tell you whether we consider it in scope and, where we can, roughly when a fix is expected.
• We keep you updated until the issue is resolved, and we will credit you (with your permission) once a fix ships.

4. Safe harbour

We will not pursue or support legal action against a researcher who acts in good faith under this policy, provided you: only interact with accounts you own or have explicit permission to test; avoid privacy violations, data destruction, and service disruption beyond what is needed to demonstrate the issue; do not access, store, or share other people's data; and give us a reasonable time to fix the issue before any public disclosure. This is a statement of intent, not a waiver of any third party's rights, and it does not authorise testing of infrastructure we do not operate (for example Cloudflare, Stripe, or a hosting provider).

5. Scope

In scope: the MyoMed Prep platforms and their APIs, authentication and session handling, the billing integration, and the operator dashboard. Out of scope: denial-of-service and volumetric attacks; automated scanner output without a demonstrated impact; social engineering and phishing of staff or learners; missing security headers with no demonstrated impact; and issues in third-party services we do not operate.

6. Bug bounty

We do not currently run a paid bug bounty. We are grateful for reports and will credit good-faith researchers; we cannot guarantee a monetary reward.

Company details