23Andme Vulnerability Disclosure

generated: '2026-08-15'
method: searched
probe: true
source: https://www.23andme.org/trust-center/
note: >-
  Upgraded on 2026-08-15. 23andMe runs a named bug bounty program on HackerOne, linked
  from its own Trust Center. The link is NOT on the security page itself — that page
  only says "We encourage security researchers and our customers to report security
  issues through our Security Program" and links back to itself, so a researcher who
  starts at /security/ never reaches the bounty. The HackerOne handle is 23andme_bbp,
  not 23andme (hackerone.com/23andme returns 404).
program:
  type: bug-bounty
  platform: HackerOne
  handle: 23andme_bbp
policy:
- https://hackerone.com/23andme_bbp?type=team
disclosure_pages:
- url: https://www.23andme.org/security/
  status: 200
  title: Our Approach to Security
- url: https://www.23andme.org/security/report-a-security-issue/
  status: 200
  title: Our Approach to Security
  note: >-
    Serves the same document as /security/. The "Security Program" call to action on
    that page points at this URL, which points back — the reporting path is circular
    and terminates without an intake form, an address, or a link to HackerOne.
contact: []
contact_note: >-
  No security@ address is published in the HTML of either disclosure page, and no
  /.well-known/security.txt is served on any 23andMe host (all probed paths 404 — see
  well-known/23andme-well-known.yml). Intake is via the HackerOne program only.
stated_practices:
  researcher_engagement: >-
    "We partner with a global community of security researchers and hire independent
    firms to constantly and ethically test our systems for vulnerabilities."
  penetration_testing: >-
    "we hire outside experts to perform extensive annual penetration tests on our
    systems."
  incident_response: >-
    "We have a dedicated incident response plan to act quickly if an event occurs. We
    are committed to notifying customers promptly and clearly if their data is
    affected."
gaps:
- id: no-security-txt
  detail: >-
    No RFC 9116 security.txt on www.23andme.org, www.23andme.com or api.23andme.com —
    every /.well-known/security.txt probe returned 404 (or a 301 to a 404).
- id: bounty-not-linked-from-security-page
  detail: >-
    The HackerOne program is reachable only from /trust-center/. The dedicated security
    and "report a security issue" pages do not link it.
evidence:
- source: https://www.23andme.org/trust-center/
  status: 200
  kind: trust center
  finding: 'anchor href="https://hackerone.com/23andme_bbp?type=team"'
- source: https://hackerone.com/23andme_bbp?type=team
  status: 200
  kind: bug bounty program
- source: https://www.23andme.org/security/
  status: 200
  kind: disclosure page
  keywords:
  - security researchers
  - report security issues
  - Security Program
- source: https://hackerone.com/23andme
  status: 404
  kind: negative probe
  finding: The obvious handle is not the program; only 23andme_bbp resolves.