OURA Vulnerability Disclosure Program

{
  "id": "5e9d5fc7-2cfe-4530-94de-c55f1d8d3a8e",
  "name": "OURA Vulnerability Disclosure Program",
  "company_handle": "ourahealthoy",
  "handle": "ouravulnerabilitydisclosureprogram",
  "url": "https://www.intigriti.com/programs/ourahealthoy/ouravulnerabilitydisclosureprogram/detail",
  "status": "open",
  "confidentiality_level": "public",
  "tacRequired": false,
  "twoFactorRequired": false,
  "min_bounty": {
    "value": 0,
    "currency": "USD"
  },
  "max_bounty": {
    "value": 0,
    "currency": "USD"
  },
  "targets": {
    "in_scope": [
      {
        "type": "wildcard",
        "endpoint": "*.ouraring.com",
        "description": null,
        "impact": "No Bounty"
      },
      {
        "type": "android",
        "endpoint": "Oura Android App",
        "description": null,
        "impact": "No Bounty"
      },
      {
        "type": "ios",
        "endpoint": "Oura iOS App",
        "description": null,
        "impact": "No Bounty"
      },
      {
        "type": "device",
        "endpoint": "Oura Ring (Gen 3 to current)",
        "description": null,
        "impact": "No Bounty"
      },
      {
        "type": "other",
        "endpoint": "Any Oura related domain",
        "description": "Please verify ownership or legitimate association via WHOIS, reverse DNS, delegated DNS, or other reliable means to ensure the asset is intended for Oura use and that Oura is the appropriate recipient of the disclosure.",
        "impact": "No Bounty"
      },
      {
        "type": "other",
        "endpoint": "Official Oura Ring Accessories",
        "description": "Any official Oura Ring accessories such as the [the Official Oura Ring 4 Charging Case](https://ouraring.com/store/accessories/oura-ring-4-charging-case) or provided ring charger.",
        "impact": "No Bounty"
      }
    ],
    "out_of_scope": [
      {
        "type": "other",
        "endpoint": "Services not hosted/owned by Oura",
        "description": "Ensure that ownership is verified before submitting disclosures to Oura.\nExamples of domains used but not hosted/owned by Oura:\n\nsupport.ouraring.com\nouraring.com/blog\n\nVulnerabilities related to or embedded in third party services used by Oura are not in scope. Bugs found in implementation of these services for Oura are. Examples:\n- weak authentication\n- public data exposure through third party",
        "impact": "Out of scope"
      }
    ]
  }
}