The Payer Map is an open, community-sourced reference dataset of US healthcare payer connectivity — payer IDs, crosswalks, and enrollment facts, each public, cited, and dated. It does not route claims, hold payer contracts, or process anyone's data. Its security concerns are therefore mostly about data integrity and provenance, plus the small amount of build/CI code in this repo.

Please do not open a public issue for security vulnerabilities.

Report privately to security@receiptshealth.com. Include:

• a description of the issue and its impact,
• the affected file(s) or commit,
• steps to reproduce (a minimal proof of concept if you have one), and
• any suggested remediation.

You can expect an acknowledgement within 3 business days and a substantive response within 10 business days. We practice coordinated disclosure and are happy to credit you unless you'd rather stay anonymous. Please give us a reasonable window to ship a fix before any public disclosure.

For incorrect or stale data (a wrong payer ID, a bad crosswalk) — that's not a security issue; please open a normal issue or PR with a citation. See CONTRIBUTING.md.

In scope

• The build and validation tooling (ci/build.mjs, ci/validate.mjs), the schema (schema/payer.schema.json), and the published dist/ artifacts — including their handling of untrusted contributed data and dependency risk.
• Data-integrity attacks: a malicious PR that injects unsourced or falsified connectivity facts, provenance/citation spoofing, or schema-bypass that would let bad data reach dist/.

Out of scope

• The hosted Receipts Health service. It is a separate, private deployment plane and is not part of this repo.

• No credentials or secrets. This is a static dataset plus offline build tooling; nothing here reads a key or holds a contract.
• No PHI and no proprietary databases. Records are built from public sources and first-hand knowledge, each cited and dated — never by copying a clearinghouse's proprietary list. If you ever find PHI, a private/leaked list, or any unsourced re-identifiable data in this repo or its history, treat it as a security incident and report it privately.

Every fact must carry a source and a date, and confidence is tracked (confirmed / reported / etc.) — see CONTRIBUTING.md. The provenance gate in CI is what keeps the map trustworthy; attempts to defeat it are in scope above.