Essity

Program Rules

• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
• Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
• Social engineering (e.g., phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
• Only interact with accounts you own or with explicit permission of the account holder.
• While you’re welcome to create accounts where they are available. We ask that you use your HackerOne alias when doing so. You can find instructions on how to find your alias here: https://docs.hackerone.com/en/articles/8404308-hacker-email-alias
• We’re unable to provide account licenses or refund expenses incurred during testing.
• Employees who have access to internal confidential information are prohibited from participating in this program. This restriction extends to household and immediate family members as well. This rule is meant to prevent conflict of interests or unfair advantage.

Testing

# Session Layer: HTTP Headers

Researchers must include the following header to all requests:

• “X-HackerOne-Research: [H1 username]”

# Unqualifying Vulnerabilities

Essity is not interested in the following submissions and we reserves the right, in our sole discretion, to reject any submission:

• Missing best practices, optional security hardening or optional email security features
• Version/banner disclosure
• Low-impact vulnerabilities
• Vulnerabilities requiring unlikely circumstances (Self XSS, tabnabbing, content spoofing, applicability only for EOL browsers)
• Activities that could lead to disruption of services or data (DoS, DDoS, spamming, physical attacks)
• Social engineering attempts

Disclosure Policy

• Researchers may publish details about identified vulnerabilities only after Essity has fully remediated them and expressed clear consent. Please note that reports closed as informative, not applicable or spam will not be approved for disclosure.
• Follow HackerOne's disclosure guidelines.

Thank you for helping keep Essity and our users safe!