We are Albertsons Companies, Inc., including its subsidiaries and affiliated entities (“Company,” “we,” “us,” and “our”). Our banners serve customers, guests, and patients across the United States.

Responsible Disclosure Policy:

This page is for security researchers interested in reporting application security vulnerabilities. This is intended for application security vulnerabilities only.

Your submission will be securely submitted to albertsons.responsibledisclosure.com, which is operated and managed by Synack, an independent third-party. All submissions that fall within the defined program scope will be carefully reviewed and validated. If your reported issue is confirmed to be a legitimate security vulnerability, you will be permitted to disclose the finding after an appropriate fix or remediation has been implemented.

Please note that participation in this process is managed exclusively through this portal only, and you are required to review and accept the terms of service in order to proceed with your submission. For any questions, updates, or follow-ups regarding your report, please direct all inquiries to albertsons.responsibledisclosure.com.

Typical Vulnerabilities Accepted:

• OWASP Top 10 vulnerability categories
• Other vulnerabilities with demonstrated impact

Typical Out of Scope:

• Theoretical vulnerabilities
• Informational disclosure of non-sensitive data
• Low impact session management issues
• Self XSS (user defined payload)

For a full list of program scope please visit the Responsible Disclosure details page

Responsible Disclosure Guidelines:

• Adhere to all legal terms and conditions outlined at Albertsons.ResponsibleDisclosure.com
• Work directly with Albertsons.ResponsibleDisclosure.com on vulnerability submissions
• Provide detailed description of a proof of concept to detail reproduction of vulnerabilities
• Do not engage in disruptive testing like DoS or any action that could impact the confidentiality, integrity or availability of information and systems
• Do not engage in social engineering or phishing of customers or employees
• Do not request compensation for time and materials or vulnerabilities discovered