Cardinal Health Vulnerability Disclosure

generated: '2026-09-05'
method: searched
source: https://hackerone.com/cardinal_health
provider: Cardinal Health
providerId: cardinal-health
program:
  present: true
  name: Cardinal Health Vulnerability Disclosure Policy
  platform: HackerOne
  handle: cardinal_health
  url: https://hackerone.com/cardinal_health
  type: vulnerability-disclosure-program
  bounty: unknown
  note: >-
    HackerOne renders the program page client-side, so the policy text, scope table
    and bounty status could not be read anonymously. Presence is confirmed by a
    fetched 200 whose body carries the string "Cardinal Health", verified against a
    negative control on a handle that does not exist, which returned 404 with the
    title "Page not found | HackerOne".
evidence:
  - url: https://hackerone.com/cardinal_health
    http_status: 200
    bytes: 2295
    fetched: '2026-09-05'
    check: body contains "Cardinal Health"
  - url: https://hackerone.com/zzz_not_a_real_program_7f3ab91c
    http_status: 404
    bytes: 1694
    fetched: '2026-09-05'
    check: negative control — a nonexistent handle 404s, so the 200 above is a real program
disclosure_pages:
  - title: Coordinated Vulnerability Disclosure (CVD)
    url: https://www.cardinalhealth.com/en/support/coordinated-vulnerability-disclosure.html
    verified: false
    http_status: null
    note: >-
      First-party Cardinal Health CVD page, surfaced by search and indexed publicly.
      NOT fetched this round: www.cardinalhealth.com completes the TLS handshake and
      then drops every non-browser connection (curl exit 000, fetch tool 60s timeout),
      so no status code was observed and no content was read. Recorded as an
      unverified reference rather than a confirmed document; it is a bot-mitigation
      wall on our side, not evidence the page is gone.
security_txt:
  served: false
  note: >-
    /.well-known/security.txt is not served on any reachable Cardinal Health host.
    See well-known/cardinal-health-well-known.yml — the three reachable web hosts are
    catch-all shells that answer 200 for a control path that cannot exist, and
    api.cardinalhealth.com returns 403 VPC Service Controls for every path.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com