generated: '2026-09-04'
method: searched
source: https://virtualincision.com/coordinated-disclosure/
program:
  published: true
  name: Coordinated Vulnerability Disclosure Policy
  url: https://virtualincision.com/coordinated-disclosure/
  http_status: 200
  contact: security@virtualincision.com
  contact_type: email
  scope: Virtual Incision medical devices, including the MIRA Surgical System and the miniRAS platform.
  required_report_contents:
  - Product and version
  - Description of the vulnerability
  - Steps to reproduce
  acknowledgement_sla: Receipt acknowledged within 10 business days.
  remediation_commitment: Analysis results and a remediation plan provided on completion.
  safe_harbor: true
  safe_harbor_basis: Good-faith reports made under this policy are addressed under FDA Section 524B (Ensuring Cybersecurity
    of Medical Devices, FD&C Act).
  bug_bounty: false
  bounty_platform: null
  pgp_key: null
  cve_numbering_authority: false
standards_referenced:
- FDA FD&C Act Section 524B
gaps:
- 'No /.well-known/security.txt (RFC 9116) — the policy exists but is not machine-discoverable; a three-line file
  naming Contact: mailto:security@virtualincision.com and Policy: https://virtualincision.com/coordinated-disclosure/
  would fix it.'
- No disclosure timeline, severity model, or public advisory feed is stated.
- No PGP key or encrypted submission channel is offered for a medical-device report.
x-evidence:
  fetched: '2026-09-04'
  url: https://virtualincision.com/coordinated-disclosure/
  http_status: 200