Program Overview
Cedars-Sinai runs a vulnerability disclosure program on HackerOne. The program has 39 in-scope assets and is managed by HackerOne's triage team.
39
In-Scope Assets
3h
Avg Response
67%
Efficiency
66d
Avg Resolve
In-Scope Assets
| Asset | Type | Max Severity | Eligible |
|---|---|---|---|
| *Hhapps.net | WILDCARD | Critical | No Bounty |
| *Hhec.org | WILDCARD | Critical | No Bounty |
| *Hmh-direct.com | WILDCARD | Critical | No Bounty |
| *Hmhdr.com | WILDCARD | Critical | No Bounty |
| *Hmhdr.net | WILDCARD | Critical | No Bounty |
| *Hmhdr.org | WILDCARD | Critical | No Bounty |
| *Hmhrx.com | WILDCARD | Critical | No Bounty |
| *Hmhrx.net | WILDCARD | Critical | No Bounty |
| *Hmhrx.org | WILDCARD | Critical | No Bounty |
| *Hmtest.org | WILDCARD | Critical | No Bounty |
| *Huntingtonhealth.net | WILDCARD | Critical | No Bounty |
| *Huntingtonhealtheconnect.com | WILDCARD | Critical | No Bounty |
| *Huntingtonhealtheconnect.net | WILDCARD | Critical | No Bounty |
| *Huntingtonhealthnetwork.com | WILDCARD | Critical | No Bounty |
| *Huntingtonhealthnetwork.net | WILDCARD | Critical | No Bounty |
| *Huntingtonrx.com | WILDCARD | Critical | No Bounty |
| *Huntingtonrx.net | WILDCARD | Critical | No Bounty |
| *SANGABRIELVALLEYHEALTHECONNECT.COM | WILDCARD | Critical | No Bounty |
| *SANGABRIELVALLEYHEALTHECONNECT.NET | WILDCARD | Critical | No Bounty |
| *appofchoice.huntingtonhospital.com/ | WILDCARD | Critical | No Bounty |
| *apps.huntingtonhospital.com/ | WILDCARD | Critical | No Bounty |
| *cedars-sinai.edu | WILDCARD | Critical | No Bounty |
| *cedars-sinai.org | WILDCARD | Critical | No Bounty |
| *csmc.edu | WILDCARD | Critical | No Bounty |
| *hhcareers.com | WILDCARD | Critical | No Bounty |
| *hhphysicians.org | WILDCARD | Critical | No Bounty |
| *huntingtonhospital.com | WILDCARD | Critical | No Bounty |
| *huntingtonhospital.net | WILDCARD | Critical | No Bounty |
| *huntingtonhospital.org | WILDCARD | Critical | No Bounty |
| *kerlanjobe.org | WILDCARD | Critical | No Bounty |
| *legacy.huntingtonhospital.org | WILDCARD | Critical | No Bounty |
| *mycslink.org | WILDCARD | Critical | No Bounty |
| *ourstory.huntingtonhospital.com/ | WILDCARD | Critical | No Bounty |
| *pricing.huntingtonhospital.com/ | WILDCARD | Critical | No Bounty |
| *sd.invio.dev | WILDCARD | Critical | No Bounty |
| *sgveconnect.com | WILDCARD | Critical | No Bounty |
| *sgveconnect.org | WILDCARD | Critical | No Bounty |
| *www.cshs.org | WILDCARD | Critical | No Bounty |
| *www.marinahospital.com | WILDCARD | Critical | No Bounty |
Tips for Hacking Cedars-Sinai
- Read the policy — Understand what's in scope, out of scope, and any specific testing restrictions before you start.
- Enumerate the attack surface — Use subdomain enumeration and directory bruteforcing to map all accessible endpoints.
- Focus on high-impact bugs — Look for SQL injection, SSRF, and IDOR vulnerabilities first.
- Test authentication flows — Check for OAuth misconfigurations and CSRF in login/signup flows.
- Write clear reports — Include steps to reproduce, impact assessment, and suggested remediation. Use Burp Suite to capture evidence.
Frequently Asked Questions
How do I start hacking Cedars-Sinai?
Sign up on HackerOne, read the program policy carefully, review the in-scope assets listed above, and start testing. Always stay within scope and follow responsible disclosure guidelines.
Does Cedars-Sinai pay bounties?
No, Cedars-Sinai runs a Vulnerability Disclosure Program (VDP) without monetary rewards. You may receive recognition or swag.
What types of vulnerabilities does Cedars-Sinai accept?
Cedars-Sinai accepts reports for vulnerabilities found in their 39 in-scope assets. Common accepted vulnerability types include XSS, SQL injection, SSRF, IDOR, authentication bypass, and RCE. Check the program policy for specific exclusions.