Hy-Vee
By Hy-Vee, Inc. Vulnerability disclosure program on HackerOne hy-vee.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 5 days
We will acknowledge receipt of your report within 5 business days.
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
- Hall of fame
-
Yes
With your consent, we will publicly acknowledge your responsible disclosure after resolution.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test.
Wildcard domains 2
- *.hy-vee.cloud Critical No bounty
- *.hy-vee.com Critical No bounty
Products and areas 1
- Other Hy-Vee owned asset Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Hy-Vee (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Report suspected vulnerabilities as soon as they are discovered.
-
Provide detailed reports including reproducible steps and supporting evidence.
-
Submit one vulnerability per report unless chaining issues is necessary to demonstrate impact.
-
Do not publicly disclose the vulnerability until it has been resolved and coordinated disclosure has been agreed with Hy-Vee.
-
Do not exploit vulnerabilities beyond what is necessary to confirm their existence.
-
Make a good-faith effort to avoid privacy violations, destruction of data, or service disruption. Only interact with accounts you own or have explicit permission to test.
-
Test only systems and assets within the defined program scope.
Not accepted
-
Social engineering attacks (e.g., phishing, vishing, smishing)
-
UI-based attacks without demonstrated sensitive impact, including clickjacking, tabnabbing, content spoofing, or open redirects
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
-
Attacks requiring privileged network positioning (MITM) or physical access to a user’s device without a realistic attack scenario
-
Reports based solely on vulnerable library/version identification without demonstrating exploitability in our environment
-
CSV injection without demonstrated impact
-
Missing security best practices in SSL/TLS configuration
-
Denial-of-Service testing or traffic flooding
-
Rate-limiting or brute-force issues affecting non-authentication endpoints only
-
Missing security best practices in Content Security Policy
-
Missing HttpOnly or Secure flags on cookies without demonstrated impact
-
Missing or misconfigured SPF/DKIM/DMARC or other email best practices
-
Vulnerabilities affecting only outdated or unsupported browsers (more than two stable versions behind)
-
Software version disclosure, banner identification, verbose error messages, stack traces, or headers without sensitive exposure
-
Self-XSS or issues requiring unrealistic user interaction
-
Issues relying on highly improbable user behavior
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Vulnerability Disclosure Program
Hy-Vee, Inc. (“Hy-Vee”) is a Midwestern grocery retailer with more than 275 stores across Illinois, Iowa, Kansas, Minnesota, Missouri, Nebraska, South Dakota, and Wisconsin.
Hy-Vee’s Security Team is committed to protecting our users and their personal information.
We encourage security researchers to work with us to identify and mitigate security vulnerabilities in order to keep our business and customers safe. If you believe you have discovered a vulnerability on our websites or within our mobile apps, we kindly ask that you disclose it to us promptly and responsibly. We will investigate your report and respond as quickly as possible. We look forward to collaborating with you to resolve any issues.
#Our Ask
- Report suspected vulnerabilities as soon as they are discovered.
- Provide detailed reports including reproducible steps and supporting evidence.
- Submit one vulnerability per report unless chaining issues is necessary to demonstrate impact.
- Do not publicly disclose the vulnerability until it has been resolved and coordinated disclosure has been agreed with Hy-Vee.
- Do not exploit vulnerabilities beyond what is necessary to confirm their existence.
- Make a good-faith effort to avoid privacy violations, destruction of data, or service disruption. Only interact with accounts you own or have explicit permission to test.
- Test only systems and assets within the defined program scope.
#Our Commitment
- We will acknowledge receipt of your report within 5 business days.
- We will investigate and provide status updates as appropriate.
- We will provide an estimated remediation timeline when possible.
- We will notify you when the issue has been remediated.
- With your consent, we will publicly acknowledge your responsible disclosure after resolution.
Out of Scope Vulnerabilities and Attacks
- Social engineering attacks (e.g., phishing, vishing, smishing)
- UI-based attacks without demonstrated sensitive impact, including clickjacking, tabnabbing, content spoofing, or open redirects
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
- Attacks requiring privileged network positioning (MITM) or physical access to a user’s device without a realistic attack scenario
- Reports based solely on vulnerable library/version identification without demonstrating exploitability in our environment
- CSV injection without demonstrated impact
- Missing security best practices in SSL/TLS configuration
- Denial-of-Service testing or traffic flooding
- Rate-limiting or brute-force issues affecting non-authentication endpoints only
- Missing security best practices in Content Security Policy
- Missing HttpOnly or Secure flags on cookies without demonstrated impact
- Missing or misconfigured SPF/DKIM/DMARC or other email best practices
- Vulnerabilities affecting only outdated or unsupported browsers (more than two stable versions behind)
- Software version disclosure, banner identification, verbose error messages, stack traces, or headers without sensitive exposure
- Self-XSS or issues requiring unrealistic user interaction
- Issues relying on highly improbable user behavior
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Thank You
We appreciate the security community’s help in protecting Hy-Vee’s customers and systems. Responsible research helps us improve and keep our platform safe for everyone.