Responsible Disclosure

iHerb Responsible Disclosure Policy

Since our founding in 1996, iHerb has been dedicated to offering the best-curated selection of health and wellness products. We recognize the vital role security researchers play in keeping iHerb and our customers safe. If you discover a vulnerability, please notify us using the guidelines and terms below. iHerb is committed to working with security researchers to verify and address any potential vulnerabilities that are reported to us in accordance with this policy.

Reporting a Potential Security Vulnerability

Please report suspected or detected vulnerabilities by completing the submission form on this page, and include the information described under Bug Submission Requirements below. If you would like to be recognized on our Contributor Hall of Fame, include your information in your report.

Disclosure Guidelines

  • Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from iHerb.
  • Follow Bugcrowd's disclosure guidelines.

Program Terms

  • Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, it will not receive a response.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only acknowledge the first report that was received (provided that it can be fully reproduced).
  • The vulnerability must demonstrate security impact to a site or application in scope.
  • If you find a domain not explicitly in scope while enumerating the website or mobile apps, please report it to the team.
  • Do not violate any laws or breach any agreements in order to discover vulnerabilities.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • Any activity that could lead to the disruption of our service (DoS) is prohibited. Use automated tools with care to avoid performance impacts.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Testing Guidelines

  • Include a header X-Bugcrowd-Research: <bugcrowd_username> and append Bugcrowd/username to your user agent when testing to identify your requests.
  • When creating an account, use your @bugcrowdninja.com email alias ([username]@bugcrowdninja.com).
  • Use the following test credit cards to test checkout. Orders placed with the following cards will not be fulfilled:
    Credit Card Type Card Number Expiry Date CVC/CVV
    American Express 3779 3521 2820 270 10/26 9179
    Visa 4718 4954 2547 9562 07/27 805
    Visa 4847 1801 5297 2716 06/28 656
    Visa 4118 1020 2793 8195 03/30 088
    Mastercard 5166 1269 0383 3343 06/28 900
    Mastercard 5456 6000 1261 2581 03/30 212
    American Express 3779 3696 5320 690 02/30 3771
  • For a US billing address, use: 301 N Lake Ave, Pasadena, CA 91101

Out of Scope Domains

  • *.iherbpreprod.*
  • careers.iherb.com
  • corporate.iherb.com
  • iherb.wgiftcard.com
  • iherbglobal.atlassian.net
  • information.iherb.com
  • iherb.okta.com
  • itsd.iherb.net

Out of Scope Endpoints

  • *.iherb*.*/metrics*
  • *.iherb*.*/env*

Out of Scope Vulnerabilities

When reporting vulnerabilities, consider (1) attack scenario/exploitability and (2) security impact of the bug. The following vulnerabilities are considered out-of-scope:

Web Application Vulnerabilities

  • Clickjacking on pages with no sensitive actions.
  • CSRF on unauthenticated forms or forms with no sensitive actions.
  • Content spoofing and text injection without a viable attack vector or ability to modify HTML/CSS.
  • Autocomplete enabled on forms.
  • Missing HttpOnly or Secure flags on cookies.
  • IDOR vulnerabilities against the CustomerID variable.
  • Lack of or insufficient CORS controls.
  • Vulnerabilities in third-party libraries without a specific security impact or lacking a working Proof of Concept.
  • Cookies not expiring after logout or cookies without expiration.

Server and Network Security

  • Missing best practices in SSL/TLS configuration, or other TLS/SSL issues (e.g., BEAST, BREACH, insecure renegotiation, bad cipher suite, expired certificates).
  • Missing security headers (e.g., HSTS, CSP, x-frame-options).
  • Software version disclosure, banner identification issues, or descriptive error messages.
  • Missing DNSSEC details.
  • No rate limiting on SSH.
  • Direct IP access on exposed origin IP.
  • Subdomain/IP takeovers not related to iherb.com.

Authentication and Session Management

  • Login or Forgot Password page brute force and account lockout not enforced.
  • Lack of rate limiting on API endpoints.
  • All sessions active after user account updates (e.g., password, 2FA, email, or phone number change).
  • CSRF on API endpoints.
  • Lack of 2FA for social/third-party logins and temporary codes.
  • Vulnerabilities requiring a user to download malicious software.

Data Privacy and Leakage

  • Disclosure of known public files or directories (e.g., robots.txt).
  • Missing email best practices (e.g., invalid, incomplete or missing SPF/DKIM/DMARC records).
  • Private IP disclosure or leakage.
  • Public S3 Bucket without sensitive information (though we'll still appreciate if you alert us).
  • Third-party tokens or API keys (e.g., Google, Addressy, Iterable) exposure.
  • Reporting of credentials from data breaches.

Mobile and Client-Side Security

  • Attacks requiring MITM or physical access to a user's device.
  • Vulnerabilities only affecting users of outdated/unpatched browsers.
  • Vulnerabilities requiring extensive user interaction.
  • Exposure of non-sensitive data on mobile devices.
  • Installing the iHerb application on jailbroken devices.

DoS and Resource Exhaustion

  • Any activity leading to service disruption (e.g., (D)DoS).

Miscellaneous

  • Broken social media links.
  • Attacks that only work against the user themselves (e.g., self-XSS).
  • Public Zero-day vulnerabilities with patches less than 1 month old.
  • Issues requiring unlikely user interaction.
  • Tabnabbing.
  • Tapjacking.
  • Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities.
  • Pre-account takeovers / Account Squatting (ie pre-registering via email that results in an ATO victim who registers via OAuth)

Bug Submission Requirements

Required Information

For all submissions, please include:

  • A full description of the vulnerability, including exploitability and impact.
  • Evidence and explanation of all steps required to reproduce the submission, which may include videos or recordings, screenshots, exploit code, traffic logs, web/API requests and responses, email address or user ID of test accounts, and IP address used during testing.
  • For RCE submissions, see the guidelines below.

Remote Code Execution (RCE) Submission Guidelines

  • Source IP address.
  • Timestamp, including time zone.
  • Full server request(s) and response(s).
  • Filenames of any uploaded files, which must include "bugcrowd" and the timestamp.
  • Callback IP and port, if applicable.
  • Any data that was accessed or created, either deliberately or inadvertently.

Allowed Actions

  • Running benign commands via the web application or interface (e.g., whoami, hostname, ifconfig).
  • Uploading a file that outputs the result of a hardcoded benign command.

Prohibited Actions

  • Uploading files that allow arbitrary commands (i.e., a webshell).
  • Modifying any files or data, including permissions.
  • Deleting any files or data.
  • Interrupting normal operations (e.g., triggering a reboot).
  • Creating and maintaining a persistent connection to the server.
  • Intentionally viewing any files or data beyond what is needed to prove the vulnerability.
  • Failing to disclose any actions taken or applicable required information.

⚠️ Important: This program does not consider purely theoretical and best-practice recommendations.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Our Commitment to Researchers

If you responsibly report a vulnerability in accordance with this policy, we will:

  • Promptly respond to acknowledge the receipt of your report.
  • Provide an estimated timeframe for addressing the vulnerability.
  • Notify you when the vulnerability has been remediated.

Contributor Hall of Fame

iHerb greatly appreciates anyone who has contributed to the security of our users by responsibly disclosing vulnerabilities to us. Thank you for your efforts!

Thank you for helping keep iHerb and our users safe!