ClinicPilot stores patient health information — names, phone numbers, ages, conditions and payment history. Security issues in this project can expose real people's medical data, so they are treated seriously.

Do not open a public issue for a security vulnerability.

Report privately through GitHub's Security Advisories form. If that is unavailable, contact the maintainer directly through their GitHub profile.

Please include:

• What the issue is and roughly how severe you think it is
• Steps to reproduce, or a proof of concept
• Affected version or commit
• Anything you know about real-world impact

Never include real patient data in a report. Use fabricated records to demonstrate the problem.

This is a small project maintained alongside clinical practice, so response times are best-effort rather than contractual. You will get an honest status either way.

Please give a reasonable window for a fix before disclosing publicly. Credit is given in the release notes unless you prefer otherwise.

Only the latest release receives security fixes.

Understanding what this app does and does not protect against.

• All data lives in a local SQLite database on the device, via Drift
• There is no server, no account, and no network transmission of patient data
• The database file sits in the app's private storage directory, protected by the Android application sandbox
• The database is not separately encrypted at rest — it relies on the device's own full-disk encryption and the OS sandbox

Practical consequence: on a non-rooted, screen-locked, modern Android device, other apps cannot read the database. On a rooted device, or one without a screen lock, those guarantees do not hold.

Known and accepted for the current stage. These are not vulnerabilities to report — they are documented gaps with issues tracking them:

• No app-level authentication. Anyone who unlocks the phone can open the app. Device lock is the only barrier.
• No database encryption key. Adding SQLCipher is on the roadmap.
• CSV export writes plaintext to shared storage. Exported files leave the app sandbox and are readable by anything with storage permission.
• PDF receipts shared through the system share sheet leave the sandbox and are handled by the receiving app.
• Release builds are currently debug-signed. A stable release keystore is required before in-app updates can work, and is tracked as a roadmap item.

• SQL injection through any user-supplied input
• Paths that leak patient data outside the app sandbox
• Data loss or corruption in a schema migration
• Exported or logged data containing information it should not
• Dependency vulnerabilities with a realistic exploit path in this app

• Physical access to an unlocked device
• Rooted or jailbroken devices
• Attacks requiring the user to install a malicious app with elevated permissions
• The absence of features already listed under Current limitations
• Reports generated by automated scanners with no demonstrated impact

If you are using ClinicPilot in practice:

• Enable a screen lock and device encryption. This is the primary protection for your patients' records.
• Back up regularly with the CSV export, and store the export somewhere safe — it is plaintext.
• Wipe the device before disposal or resale.
• You remain responsible for compliance with local medical data regulations, including India's Digital Personal Data Protection Act, 2023 where applicable. This software is a tool; it does not make your practice compliant on its own.