Felix Health Managed Bug Bounty Engagement

Description

Felix Health (“Felix”) is an integrated healthcare platform operating in Canada. Patients using the Felix platform can get treatment for specific classes of conditions in consultation with licensed healthcare practitioners. The care provided on the Felix platform is provided by nurse practitioners (“NPs”) or Doctors of Medicine (“MDs”), collectively “HCPs”. They are duly licensed in their region(s) of practice. These individuals practice independently with the assistance of the platform’s operations and technology teams to provide safe, evidence-based healthcare. When requested, Felix can ship medication directly to patients on a regular cadence. No technology is perfect and Felix Health believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Felix Health not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Felix Health, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Credentials You have been provisioned a pseudo-random @bugcrowdninja email that has been pre-provisioned to an account with access to the app - which, after accepting the program invite, will route all incoming traffic to the email associated with your Bugcrowd account. An invite to the application has been sent to each of these emails in advance and will be auto-forwarded upon accepting your invite to the program. You must use the following request header: Identifier │ Header │ Example Username │ X-Bug-Bounty: Bugcrowd- │ X-Bug-Bounty: Bugcrowd-proresearcher About the Bug Bounty Program The focus of our bug bounty program will be the patient experience at Felix. The patient experience is made of two pieces: quiz and patient dashboard. Quiz : A prospective patient is directed to the quiz from our marketing site or from online advertisements. The quiz is treatment-specific (ex. if the patient is seeking treatment for acne, then they use the acne quiz) and asks the patient a series of personal and health-related questions. Once all questions have been answered, the patient enters their shipping and billing information before submitting their quiz. The patient is then redirected to the patient dashboard. Some features of the quiz are: Different question types (ie. free-form, single/multiple choice, image upload) Save and exit a quiz in progress Collect billing and insurance information Custom support chat using Intercom Patient dashboard : An existing patient logs into the patient dashboard to manage their treatment. Maybe they want to chat with support, ask their healthcare practitioner a question, or request an early refill of their medication - all of this can be done via the patient dashboard. Patients also use the patient dashboard to manage account settings like shipping and billing information. Some features of the patient dashboard are: Patient/prescriber chat (text messages, file upload, etc.) Manage photo ID, email address, password Manage Billing and insurance information Pause, resume, cancel treatment Out of Scope Targets Felix_Out_of_Scope.pdf Out of Scope Vulnerabilities Pharmacist and Medical Practitioner Social engineering attempts on our staff including phishing emails Vulnerabilities in a vendor we integrate with Lack of email address verification during account registration Generic information disclosure (e.g. stack trace) without additional impact Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.

Additional information

For both public (no auth) and protected (gated by auth) endpoints, we intentionally use a uuid to identify resources as a way to "protect" the endpoint against IDOR. If an endpoint is public and only identifies resources with uuid , then any IDOR submission will be marked as informational. We do expect all of these endpoints to be rate limited to prevent uuid enumeration - if one of these endpoints is discovered to not have rate limiting, we consider it a bug.

In Scope (in scope)

Target Groups The environment bugcrowd..felixforus.ca is a full-stack deployment of our application created for the bugcrowd program. Internal portal UIs and APIs are out of scope, with the exception of the internal portal login at bugcrowd.lucky.felixforus.ca/nova/login . Out of scope Felix's production application at *.felixforyou.ca is strictly out of scope. Experimenting on this application will result in program ban. bugcrowd.charm.felixforus.ca This is the primary patient user interface. Patients use this UI for most workflows: complete an onboarding questionnaire, manage their treatment (pause, cancel, resume their medication shipments), chat with their doctor, and find new treatments. To use this UI, patients must sign in. The only patient workflow that does not require authentication is the first part of the onboarding questionnaire - however, we do require the patient to sign-in midway through. The application is built using Vue JS with Nuxt JS. bugcrowd.lucky.felixforus.ca This is our primary patient experience API. The primary patient UI (bugcrowd.charm.felixforus.ca) uses this API for all workflows. Some functionality included in this API is: billing, quiz recommendations, and managing treatments (pause, cancel, resume shipments). This application is build using Laravel. bugcrowd.lucky.felixforus.ca/nova/login The login page for our internal portal, which is its only public entry point. This login page is in scope for security testing. Researchers are encouraged to evaluate the security of the authentication flow and attempt to gain unauthorized access to the portal. Once authenticated access is obtained, all functionality inside the internal portal is strictly out of scope.