HealthTechDeviceApi is a portfolio and learning project for healthcare software engineering. It must not be used to process real patient information or other production health data.
Only synthetic, generated or appropriately de-identified demonstration data may be committed to this repository.
Never commit:
- patient names or identifiers
- medical record numbers
- DICOM files containing identifiable patient information
- credentials, API keys or connection secrets
- production configuration
The repository uses automated dependency monitoring, CodeQL analysis, dependency vulnerability checks, Docker verification and source-integrity checks. In non-Development environments the API fails closed unless a 32+ character API key is configured. Security-sensitive changes should be covered by automated tests and reviewed before merging to the default branch.
Do not publish exploitable security details in a public issue. Report suspected vulnerabilities privately to the repository owner through an appropriate private contact channel.
- Validate untrusted input at system boundaries.
- Apply least privilege.
- Keep secrets outside source control.
- Avoid sensitive information in application logs.
- Keep dependencies current.
- Run the application container as a non-root user.
- Keep production API endpoints authenticated and rate-limited.
- Keep persistent application data on a dedicated writable volume.
- Prefer secure defaults and explicit failure modes.