Gymshark Vulnerability Disclosure

generated: '2026-08-04'
method: searched
probe: true
program:
  name: Gymshark - Vulnerability Disclosure Program
  type: vulnerability-disclosure-program
  platform: HackerOne
  handle: gymshark
  managed: true
policy:
- https://hackerone.com/gymshark
policy_versions: https://hackerone.com/gymshark/policy_versions
contact:
- https://hackerone.com/gymshark
summary: >-
  "The Gymshark Vulnerability Disclosure Program enlists the help of the hacker community
  at HackerOne to make Gymshark more secure." Gymshark runs a managed vulnerability
  disclosure program on HackerOne with a public policy page and a public policy version
  history. Reports are submitted through HackerOne rather than by email.
gaps:
- >-
  Gymshark publishes no RFC 9116 security.txt on any of its own hosts. Every
  /.well-known/security.txt probe against www.gymshark.com, auth.gymshark.com and the
  regional storefronts returned 404. The one security.txt that does answer 200 on a
  gymshark.com host — support.gymshark.com — is Intercom's, canonical to
  app.intercom.com, and points researchers at Intercom's Bugcrowd program, not at
  Gymshark's HackerOne program. A researcher following the standard discovery path
  would be routed to the wrong vendor.
- >-
  There is no vulnerability-disclosure or security page linked from gymshark.com
  itself (/security, /pages/security, /responsible-disclosure and
  /vulnerability-disclosure all return 404), so the HackerOne program is only findable
  by searching for it.
recommendation: >-
  Publish https://www.gymshark.com/.well-known/security.txt with
  `Policy: https://hackerone.com/gymshark`, a `Contact:` line, `Expires:` and
  `Preferred-Languages:`, and serve it from every regional storefront host. That is a
  single static file and it closes the discovery gap above.
evidence:
- {source: 'https://hackerone.com/gymshark', kind: vdp-policy-page, http_status: 200,
  fetched: '2026-08-04'}
- {source: 'https://hackerone.com/gymshark/policy_versions', kind: vdp-policy-history,
  http_status: 200, fetched: '2026-08-04'}
- {source: 'https://www.gymshark.com/.well-known/security.txt', kind: security.txt,
  http_status: 404, fetched: '2026-08-04'}
- {source: 'https://support.gymshark.com/.well-known/security.txt', kind: security.txt,
  http_status: 200, attribution: Intercom, canonical: 'https://app.intercom.com/.well-known/security.txt',
  counted: false, fetched: '2026-08-04'}