Contact: mailto:bug-reports@hm.com
Expires: 2027-08-24T23:59:59Z
Canonical: https://www.hm.com/security.txt
Preferred-Languages: en

---

H&M Group operates a Vulnerability Disclosure Program (VDP) and accepts good-faith reports of security vulnerabilities.

- Provide affected assets, reproduction steps, impact, and relevant evidence.
- Do not access, modify, delete, or retain data beyond what is necessary to demonstrate a vulnerability.
- Do not conduct automated scanning, disrupt services, degrade availability, or impact other users.