Responsible Vulnerability Disclosure Policy

This information is intended for security researchers who are interested in reporting vulnerabilities to Phreesia’s security team. For all other issues and inquiries, including sales and client support questions, please visit our Contact Us page.

If you think you have identified a vulnerability on Phreesia’s platform, we ask that you contact us at security@phreesia.com as soon as possible and refrain from disclosing the issue to other parties until we address it.

When we receive an issue we will evaluate it and, if we agree it is a vulnerability, we’ll work to fix it and release the fix in a timeframe that matches the severity. Let us know if you would like credit for discovering the issue. We can cite you as the discoverer if we weren’t previously aware of the issue.

Responsible Disclosure Guidelines

We require that all security researchers:

• Use Phreesia’s security@phreesia.com address to notify us of the vulnerability. We will send instructions for setting up a secure channel to transmit sensitive details, including URLs, screenshots and/or other relevant information.
• Give Phreesia 30 days to review the submitted issue and respond to your notification. Once we determine an issue is valid, we will notify you with next steps, including public disclosure timelines.
• Make every effort to maintain the integrity of Phreesia’s data and avoid privacy violations, service disruptions, degradation of user experience and destruction of data during testing.

The following vulnerability categories are of greatest interest to us and should be considered within the acceptable scope for security researchers:

• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• SQL Injection (SQLi)
• XML External Entity (XXE) Processing
• Authentication-related issues
• Authorization-related issues
• Data Exposure
• Redirection Attacks
• Remote Code Execution