Vulnerability Disclosure Program

Terms & Conditions

If you discover a security vulnerability, please give us the chance to fix it by emailing us at [email protected]. Publicly disclosing a security vulnerability without informing us first puts the rest of the community at risk. When you notify us of a potential problem, we will work with you to make sure we understand the scope and cause of the issue.

If you would like to be eligible for responsible vulnerability disclosure, please read this carefully.

Program Terms

Security is critical to our organization. If you believe you've found a security bug in our in-scope applications or infrastructure, we are happy to work with you to resolve the issue promptly.

Your participation in our Vulnerability Disclosure Program is voluntary. By participating in our Vulnerability Disclosure Program, submitting a report, or otherwise disclosing a vulnerability to us (“Submission”), you are indicating that you have read and agree to follow the rules set forth on this page (“Program Terms”).

Confidentiality

Any information you receive, collect or otherwise obtain about us, our services, our affiliates, or any of our members, employees, or agents in connection with our Vulnerability Disclosure Program (whether after or before you participate in the Vulnerability Disclosure Program, notably as a result of you finding and/or investigating a security bug in our in-scope applications or infrastructure) (“Confidential Information”) must be kept confidential, only used in connection with the Vulnerability Disclosure Program and not disclosed to any third party. You may not use, disclose or distribute any such Confidential Information, including without limitation any information regarding your participation in our Vulnerability Disclosure Program and any Submission.

By participating in our Vulnerability Disclosure Program, you represent and warrant that you have not used and will not use Confidential Information for any purpose other than in connection with the Vulnerability Disclosure Program and that you have not shared and will not share such Confidential Information with any third party.

Once a Submission is made, Hims & Hers reserves the right to request from you, and you already accept to abide by this request, to securely and irreversibly delete any data related to such Submission, including, without limitation, any data about us, our services, our affiliates or any of our members, employees or agents. Additionally, you agree to securely and irreversibly delete any data related to the Submission immediately upon it no longer being reasonably necessary to retain for the purposes of conveying the impact or scope of the reported issue, after verifying with Hims & Hers that it is no longer necessary, and/or if the Submission is closed, regardless of the outcome.



To participate in our Vulnerability Disclosure Program, you must:

  • Not be in violation of any national, state, or local law or regulation with respect to any activities directly or indirectly related to our Vulnerability Disclosure Program.
  • Not be employed by Hims & Hers or any of its affiliates or an immediate family member of a person employed by Hims & Hers or any of its affiliates.
  • Stay in scope.
  • Abide by all relevant laws.

Response Targets

We will make our best effort to reply, triage, and remediate any reported vulnerabilities. Resolution time will depend on severity and complexity. Progress updates will be provided through the process as appropriate.

Disclosure Policy

  • We commit to acknowledging disclosed vulnerabilities promptly and working with the security research community to mitigate or remediate weaknesses.
  • We ask participating security researchers to:
  • Not discuss this program, any reported vulnerabilities (even if resolved), or any related details outside of the program without express consent from the organization.
  • Not include sensitive or identifying data in plain text in any of the disclosures.
  • Adhere to the disclosure guidelines outlined here.

    Additional policy details may be found in the root-level /.well-known/security.txt file on some of our domains.

Program Rules

  • Please do not run mass scanning on Hims & Hers domains. Offending IP addresses will be blocked.
  • Please provide detailed reports of the process you used and vulnerabilities identified with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
  • Do not engage in social engineering (e.g., phishing, vishing, smishing).
  • Avoid violating individual privacy rights, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.
  • Do not exploit beyond what is necessary to demonstrate vulnerability presence.
  • Do not access the content of communications, data, or information on any Hims & Hers information systems except to the extent that information directly relates to the vulnerability and is necessary to prove that the vulnerability exists.
  • Do not store or share non-public data obtained through testing except to the extent necessary to communicate the finding to us.
  • If you are uncertain whether to continue testing, please engage with our team at security at forhims.com.

Scope

In-scope Targets

Any publicly accessible system owned, operated, or controlled by the Hims & Hers, including any Hims & Hers owned web applications or services hosted on those systems.

Some of the assets under .forhims.com, .forhers.com, *.forhims.co.uk, etc may be third-party systems not owned by Hims & Hers. Reports on these assets might fall out of scope for this program upon triage by our security team.

Out-of-scope Targets

  • People, including Hims & Hers employees, contractors, and vendors.
  • Physical assets, including any Hims & Hers property, facilities, and physical security controls.

Activities

In-scope activities

Activities are limited exclusively to:
  • Testing to detect a vulnerability or identify an indicator related to a vulnerability
  • Receiving Hims & Hers information about a vulnerability or an indicator related to a vulnerability

    All testing activities should abide by relevant laws.

Header identification:

Sometimes abnormal traffic can be considered malicious.
Please consider providing the following header to allow us to correctly identify your traffic:

VDP-HimsAndHers-Researcher: username or email
Out-of-Scope Activities

  • Do not harm Hims & Hers, its customers, employees, or contractors
  • Do not intentionally compromise the privacy or safety of Hims & Hers personnel or any third parties
  • Do not intentionally compromise the intellectual property or other commercial or financial interests of any Hims & Hers personnel or entities, or any third parties.
  • Do not use “fuzzers”, scanners, or other automated tools to find vulnerabilities.
  • Do not exfiltrate or retain any data or sensitive information under any circumstances
  • Do not detrimentally compromise/alter, or destroy Hims & Hers or customer data
  • Do not perform physical testing
  • Do not perform social engineering, including but not limited to phishing, vishing, smishing, etc.
  • Do not perform denial of service testing, including resource exhaustion
  • Do not hijack or intentionally disrupt legitimate user sessions
  • Do not degrade the quality of Hims & Hers assets, resources, or information
  • Do not conduct or initiate fraudulent financial transactions
  • Do not mass-create accounts to perform testing against our applications and services.
  • Do not upload rootkits, malware, or otherwise go beyond what is necessary to prove a vulnerability exists.
  • Do not leave systems in a more vulnerable state.
Out-of-Scope Vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) the security impact of the bug. The following issues are considered out of scope:

  • Clickjacking on pages with no sensitive actions
  • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
  • Attacks requiring Man in the Middle (MITM) or physical access to a user's device.
  • Previously known vulnerable libraries without a working Proof of Concept.
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability.
  • Missing best practices in SSL/TLS configuration without proof of concept/demonstrating a vulnerability.
  • Any activity that could lead to the disruption of service (DoS) for Hims & Hers
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
  • Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website/application
  • Rate limiting or brute-force issues on non-authentication endpoints
  • Missing best practices in Content Security Policy without demonstrating a vulnerability.
  • Missing HttpOnly or Secure flags on cookies not related to authentication or sessions
  • Missing email best practices (invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.)
  • Vulnerabilities only affect users of outdated or unpatched browsers (More than 2 stable versions behind the latest released stable version)
  • Software version disclosure/banner identification issues / descriptive error messages or headers (e.g. stack traces, application or server errors).
  • Tabnabbing (persuading users to submit login details and passwords by impersonating a Hims & Hers website)
  • Open redirect - unless an additional security impact can be demonstrated
  • Issues that require unlikely user interaction unless an additional security impact can be demonstrated
  • Third-party API Keys/Secrets embedded in mobile applications, without a clear impact, as many third-parties require this for their own client attribution purposes.
  • Unrestricted file uploads without a clear impact, beyond resource consumption, DoS, undesirable content, etc.
  • Login/Logout CSRF
  • Self-XSS
  • Absence of rate limits

Safe Harbor

We do not intend to assert claims under the Computer Fraud and Abuse Act or claims of trespass or similar legal theories against researchers who undertake in good faith to test our systems for vulnerabilities and who bring their findings promptly to our attention. You are expected to comply with all laws applicable to you and not to disrupt or compromise any data beyond what this VDP permits.

We reserve the right in our sole discretion to determine whether your actions are taken in good faith, are consistent with this policy, or are an inadvertent violation. Please contact us before engaging in conduct that you think might be inconsistent with or unaddressed by this policy. Your efforts to proactively contact us before engaging in any action inconsistent with or unaddressed by this policy will be an important factor in our determination. Thank you for helping keep Hims & Hers and our users safe!

Rights and Licenses

We may modify the Program Terms at any time.

By making a Submission, you represent and warrant that the Submission is original to you and you have the right to submit the Submission.

By making a Submission, you give us the right to use your Submission for any purpose.

Top Researchers

Researchers are listed here based on adherence to these program guidelines, professionalism, and significance or novelty of the issue(s) reported:

COMING SOON

Public Key

If you choose to email us and should you deem it necessary, our public key for [email protected] is under https://www.forhims.com/security/publickey.txt