Hi Medplum team, I recently submitted several private security vulnerability reports to security@medplum.com in accordance with your security reporting policy. I just wanted to ask whether researchers normally receive an acknowledgement or confirmation of receipt after submitting a report, or whether I should simply wait for the security team to complete triage. I will not share any vulnerability details here publicly. I only want to make sure that my submissions were received successfully. Thank you!

Hi @GoatGreat - Thank you for filing security issues and for following the responsible disclosure policy. We typically acknowledge receipt in a timely fashion. I just took a look, and we have replied to all non-spam emails sent to security@medplum.com in the past month. Anonymous security emails are often flagged as spam. Can you please send the timestamp, subject line, sender, etc? You can send me a DM if you prefer.

Hi Cody, thank you for checking. The reports were sent from mf3493297@gmail.com to security@medplum.com. There were 14 separate disclosure emails sent between: - October 4, 2026 at 13:57 CEST - October 5, 2026 at 00:48 CEST The first subject was: [Private Security Disclosure][Medium][MEDPLUM-01] Stale presigned Binary URLs retarget to current version The last subject was: [Private Security Disclosure][Medium][MEDPLUM-16] Read-only Patient access creates persistent SMART Health Links Each email included a separate PDF attachment and a unique MEDPLUM report identifier. Gmail Sent-folder readback was verified for all 14 messages. Could you please check the spam or quarantine folder for messages from that sender? I can provide the complete subject list and exact timestamps privately if needed. Thank you.