Please report security issues privately through GitHub's Report a vulnerability button on this repository's Security tab (private vulnerability reporting), or by email to hello@nirmitee.io with the subject "Security: davinci-crd-server". Do not open a public GitHub issue, pull request or discussion for a suspected vulnerability.

Include as much of the following as you can:

• the affected implementation (go/, dotnet/ or both) and the commit or release
• a description of the issue and its impact
• steps to reproduce, using synthetic data only
• any suggested fix

We aim to acknowledge a report within five business days and to keep you informed while we investigate. Once a fix is available we will publish an advisory and credit the reporter unless you ask us not to.

Never include real patient data, member identifiers, access tokens, JWTs, private keys or production URLs in an issue, pull request, log excerpt or security report. Use the synthetic data in testdata/ to reproduce problems. If you have accidentally posted sensitive data, report it privately the same way so it can be removed.

The project has not published a tagged release yet.

This server is a reference implementation of the Da Vinci CRD payer side. Before using it with real data:

• run it behind TLS 1.2 or higher (the server itself listens on plain HTTP)
• keep hook authentication on; CRD_AUTH_DISABLED=true is for local development only
• restrict CRD_TRUSTED_ISSUERS to the CDS clients you actually trust (the defaults are the Inferno test issuers)
• replace the sample spec/payer-rules.json with your own rules
• protect the audit log directory, because audit lines contain request and response bodies (access tokens are redacted, clinical content is not)