Best Buy
Vulnerability disclosure program on HackerOne bestbuy.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 1
- Public CVEs
- 3
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 2 days
Best Buy commits to provide prompt acknowledgement of receipt of all reports (within two business days of submission)
- Safe harbor
-
Full
For any activity you conduct in compliance with this policy, Best Buy will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 3 excluded.
Products and areas 1
- Best Buy owned asset Critical No bounty
Out of scope (3)
- *.chealth.io
- *.currenthealth.com
- *.snap40.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Best Buy (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Do not disclose the potential security issue to any third party without Best Buy’s prior written permission.
-
Avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
-
Do not engage in any denial of service.
-
Do not engage in any spamming of our customers or potential customers.
-
Do not engage in social engineering (including phishing) of Best Buy employees or contractors.
-
Do not engage in any physical attempts against Best Buy property or data centers.
-
Domain and Subdomain Takeovers: demonstrate that you are able to take over the page by leaving a non-offensive message, such as your username.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 56 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
*.chealth.io (out of scope)
-
Scope added
*.currenthealth.com (out of scope)
-
Scope added
*.snap40.com (out of scope)
-
Scope added
Best Buy owned asset
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-1385 | Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS 7.6.3.3. | High 7.1 | 3 May 2023 |
| CVE-2023-1384 | The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3. | Medium 4.3 | 3 May 2023 |
| CVE-2023-1383 | An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3. | Medium 5.4 | 3 May 2023 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Responsible Disclosure Policy
We at Best Buy work hard every day to enrich the lives of consumers through technology, whether they come to us online, visit our stores or invite us into their homes. Best Buy is committed to protecting our customer data. No technology is perfect, and Best Buy believes that working with skilled security researchers is crucial in identifying weaknesses in any technology. If you believe you’ve found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly.
For any activity you conduct in compliance with this policy, Best Buy will not initiate legal action against you.
General Policy Guidelines
In order to protect our company, our customers and their data, you must accept and comply with the following guidelines:
- Do not disclose the potential security issue to any third party without Best Buy’s prior written permission.
- Avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
- Do not engage in any denial of service.
- Do not engage in any spamming of our customers or potential customers.
- Do not engage in social engineering (including phishing) of Best Buy employees or contractors.
- Do not engage in any physical attempts against Best Buy property or data centers.
- Domain and Subdomain Takeovers: demonstrate that you are able to take over the page by leaving a non-offensive message, such as your username.
- Once a report is submitted, Best Buy commits to provide prompt acknowledgement of receipt of all reports (within two business days of submission) and will keep you reasonably informed of the status of any validated vulnerability that you report through this program.
- Submitted reports are received and processed by a third-party provider of Best Buy.
- You give us the right to use the content of your report for any purpose.
- Submission of a report does not create a consumer, employment, or agency relationship between you and Best Buy.
- Submitting a valid vulnerability report does not guarantee a reward. Rewards, if any, are at Best Buy’s sole discretion.
- Retesting Resolved Reports: Researchers must operate in good faith. They are encouraged to maintain open communication with our security team regarding any findings or potential issues during the retest phase. Additional insights on how security fixes can be made more robust, reducing the likelihood of bypasses will be taken into account when considering the validity of reported bypasses.
- Best Buy may update this policy from time to time.
By reporting a security bug or vulnerability, you agree to the terms and conditions of this Responsible Disclosure Policy. The information you provide will be handled according to the Best Buy Privacy Policy.
Thank you for helping keep Best Buy and our customers secure.