Security
Report a vulnerability.
If you find a security problem in Driveway, tell us first. We will answer within one business day, fix confirmed issues quickly, and credit you here if you want.
What we promise
- Acknowledgement within one business day.
- A named contact and status updates until the fix ships.
- No legal action against good-faith research that follows this page.
- Credit on this page, if you want it, once the issue is fixed.
Ground rules
- Test only against accounts you own. Never access another clinician’s notes or recordings.
- No denial of service, spam, or social engineering of our team or users.
- If you reach data that is not yours, stop, do not copy it, and tell us.
- Give us a reasonable window to fix before any public write-up.
In scope
drivewaynotes.com, the app under /app, the API under /api, the Chrome extension, and the mobile wrappers. Third-party services we use (Supabase, Vercel, Stripe, OpenAI, Anthropic, Resend, Twilio) have their own programs.
Machine-readable: /.well-known/security.txt