Private · inviteHealthcareManaged triageSafe harborNo disclosure

Meridian Health

Patient scheduling and records exchange for 1,900 clinics.

Escrowed · $260klaunched 15 Jan 2025

pgn scope pull meridian-health

Submit report

Response, measured

last 90 days

Median triage

22h

commitment 48h

Median to bounty

12d

commitment 24d

Queue right now

58 received · 27 resolved

Response score

91%

within commitment

Triage: median vs commitment22h / 48h

Bounty: median vs commitment12d / 24d

Escrow

$260,000

Held by Peregrine, released automatically on resolution. Covers 6 critical payouts at top of band.

Paid all-time

$640k

Hunters thanked

Bounty table

critical$12k – $40k
high$4,000 – $12k
medium$1,000 – $4,000
low$250 – $1,000

Bands are floors and ceilings the program is held to. Mediation can move a report within a band, never below the floor of its agreed severity.

Scope · 3 assets

signed · diff feed available

Asset	Type	Max severity	Eligible	Note
portal.meridianhealth.example	web	critical	yes	Patient and clinician portal
fhir.meridianhealth.example	api	critical	yes	FHIR R4 endpoint
com.meridian.patient	mobile	high	yes	Patient app

Out of scope

Any access to non-test patient data beyond the minimum needed to prove the issue
Physical security

Policy

Invite-only. Researchers receive seeded test clinics; proof must use those tenants exclusively. Reports touching real patient data are paid but trigger a mandatory incident review.

#fhir#phi#oauth

Recent reports · 1

Filter hacktivity →

criticalPGN-10439· undisclosed
FHIR $everything operation returns documents across seeded test clinics
Not disclosed. Private program.
@sableImproper Authorization15 Oct 2026triage 22hresolved 12.1d
$32,000
Resolved

Top hunters here

1@sable$32k1 resolved

Meridian Health

FHIR $everything operation returns documents across seeded test clinics