HealthEquity
HealthEquity is a benefits administrator offering HSA, FSA, HRA, and COBRA plans, trusted by 120,000+ organizations to simplify health benefit management.
External Program
Submit bugs directly to this organization
HealthEquity
HealthEquity is a benefits administrator offering HSA, FSA, HRA, and COBRA plans, trusted by 120,000+ organizations to simplify health benefit management.
External Program
Submit bugs directly to this organization
This section is for security researchers who are interested in reporting security vulnerabilities on the HealthEquity platform. We value the assistance of the security research community and encourage researchers or others to report any potential vulnerabilities in accordance with the guidelines below.
We will not pursue legal action against researchers who comply with the HealthEquity defined responsible disclosure process.
HealthEquity does not operate a bug bounty program and makes no offer of reward or compensation. If you are the first to report a qualifying vulnerability and would like to be included in our Security Researcher Hall of Fame, please provide us with your name and a link for recognition.
We will not pursue legal action against researchers who comply with the HealthEquity defined responsible disclosure process.
Email us at [email protected].
When the HealthEquity Information Security Team receives a report, we will send an acknowledgement within three business days. Request(s) for further information may be sent as needed. After validation/verification of a vulnerability, additional communications will be sent through resolution.
HealthEquity will not negotiate in response to a threat (e.g., a threat of withholding, or threat of releasing the vulnerability to the public). However, we will work with you, and ask that you allow us a reasonable amount of time for both the validation/verification and the resolution of the vulnerability before taking action to make it public. We will not share names or contact data of security researchers unless given explicit consent.
Reporting of vulnerability information to other third parties or vendors will be determined at the discretion of HealthEquity.
All publicly accessible domains, applications, and systems owned by HealthEquity and its subsidiaries. If you have any other information you would like to provide to our security team, please do so via the Reporting Instructions.
When reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
HealthEquity would like to publicly express our gratitude to the following security researchers for responsibly disclosing vulnerabilities and working with us to remediate them. We truly appreciate your remarkable efforts!