Responsible Disclosure Policy

In order to protect our company, our customers and their data, you must accept and comply with the following guidelines:

• Do not disclose the potential security issue to any third party without Best Buy’s prior written permission.
• Avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
• Do not engage in any denial of service.
• Do not engage in any spamming of our customers or potential customers.
• Do not engage in social engineering (including phishing) of Best Buy employees or contractors.
• Do not engage in any physical attempts against Best Buy property or data centers.
• Once a report is submitted, Best Buy commits to provide prompt acknowledgement of receipt of all reports (within two business days of submission) and will keep you reasonably informed of the status of any validated vulnerability that you report through this program.
• Submitted reports are received and processed by a third-party provider of Best Buy.
• You give us the right to use the content of your report for any purpose.
• Submission of a report does not create a consumer, employment, or agency relationship between you and Best Buy.
• Payment of any reward is made at Best Buy’s sole discretion.
• Best Buy may update this policy from time to time.

By reporting a security bug or vulnerability, you agree to the terms and conditions of this Responsible Disclosure Policy. The information you provide will be handled according to the Best Buy Privacy Policy.

Thank you for helping keep Best Buy and our customers secure.