Strava accepts security vulnerability reports through HackerOne. Follow the steps below to send a report.
Before You Report
Send one vulnerability per report. If you found more than one issue, send a separate report for each one.
You need a HackerOne account to submit a report. If you do not have one, create one first.
How to Submit a Report
Email your report to [email protected].
Open the automatic reply from HackerOne. It contains a link.
Use that link to submit your report to Strava’s HackerOne triage queue.
Where to Find the Full Instructions
Strava posts its vulnerability reporting instructions at strava.com/.well-known/security.txt.
FAQs
Who do I contact if I have a question about reporting a vulnerability?
Email [email protected]. Use [email protected] only to submit a report.
I think someone is using my account. Is this where I report it?
No. This process is only for security vulnerabilities. If you have a problem with your own account, contact Strava Support.