Security Guide — 24Heal

Security is the first priority.

This document explains how patients, doctors, and contributors should protect accounts and data. It is written for a public audience.

1. Security principles

1. Least privilege — users only access data for their role (patient or doctor).
2. No secrets in public docs — credentials, admin tools, and private ops contacts stay out of GitHub/README docs.
3. Private by default — dashboards, payments, prescriptions, and documents are authenticated.
4. Verification before trust — doctors are reviewed before public listing.
5. Assume compromise is possible — use unique passwords and sign out on shared devices.

2. What we never publish in public documentation

Do not add any of the following to README files, public docs, tickets, or screenshots shared outside the trust boundary:

| Never publish | Why |

|---------------|-----|

| Admin panel URLs, menus, or “how to admin” guides | Attack surface & privilege abuse |

| Staff emails / internal phone / WhatsApp numbers | Social engineering & spam |

| Database URLs, connection strings, Prisma credentials | Full data breach risk |

If you find a secret accidentally committed: rotate it immediately and treat it as compromised. Do not merely delete the file from the latest commit.

3. Account safety (patients & doctors)

Passwords

• Minimum length enforced by the product (at least 8 characters at registration).
• Prefer a long passphrase or password manager.
• Never reuse your 24Heal password on email, banking, or social apps.

Sign-in hygiene

• Bookmark the official site: https://24healer.com
• Check the browser address bar before entering credentials.
• Ignore messages that ask you to “confirm your password” on an unfamiliar link.
• Use Forgot password only from the official site.

Shared devices

• Always use Log out.
• Do not save passwords on public computers.
• Clear the browser session if you used a kiosk or clinic shared PC.

Phishing red flags

• Urgent threats (“account closes today”)
• Requests for OTP, password, or card CVV by chat
• Links that look like 24healer but use a different domain
• Attachments asking you to “enable macros” or install software

4. Protecting health information

Users should:

• Share only necessary clinical details with their doctor through the platform flows
• Avoid posting prescriptions or lab reports publicly
• Be careful when downloading documents onto shared phones

Doctors should:

• Access only patients related to their authorised care
• Avoid exporting patient lists to personal devices without need
• Use professional judgement and applicable privacy law

24Heal’s public legal pages:

• Privacy — https://24healer.com/privacy
• Terms — https://24healer.com/terms
• Medical disclaimer — https://24healer.com/medical-disclaimer

5. Platform security behaviours (public summary)

These are product behaviours, not an invitation to test attacks:

| Area | Behaviour |

|------|-----------|

Do not attempt penetration testing against the production site without written authorisation from the platform owner.

6. Guidance for developers / contributors

Safe defaults

• Never commit .env, .env.local, key files, or dumps of production data.
• Prefer environment variables injected by the host — not hardcoded secrets.
• Keep admin functionality undocumented in public markdown.
• When writing docs or demos, use obvious fake data (patient@example.com, Dr. Example).

Before opening a pull request

• [ ] No secrets in diff
• [ ] No real patient data in fixtures
• [ ] No admin how-to in public docs
• [ ] Screenshots redact emails, phones, and IDs

Reporting a vulnerability

If you believe you found a security issue:

1. Do not open a public GitHub issue with exploit details.
2. Contact the team through the official website Contact page and mark the subject as a security concern.
3. Allow reasonable time for a fix before any public disclosure.

7. Incident checklist (for users)

If you suspect someone accessed your account:

1. Change your email password (the inbox that receives reset links).
2. Change your 24Heal password via Forgot password / profile settings.
3. Sign out other sessions if the product offers that control.
4. Review recent appointments, orders, and profile changes.
5. Contact 24Heal via the official Contact page.

8. Related guides

• [Website Guide](./WEBSITE-GUIDE.md)
• [Patient Guide](./PATIENT-GUIDE.md)
• [Doctor Guide](./DOCTOR-GUIDE.md)

Remember: Strong security is a shared responsibility. The strongest platform still fails if passwords are reused or shared.