{"id":"af9ccf7e-a1a6-4a58-bdab-6ebfee0ca61b","engagementId":"ccab6e09-7297-4897-8ea1-33c5b80f048e","data":{"brief":{"id":"458ced00-56c8-4bd1-bb38-f1c7037489cb","name":"Genius","tagline":"Genius: More than the music","description":"\u003cp\u003eGenius is \"more than the music\": a celebration of lyrics, the stories behind the songs, and the creative connections that meaningfully drive culture. The world's biggest music encyclopedia, Genius is powered by its community, its in-house creative team, and the artists themselves. Genius serves music knowledge to over 80 million people each month on Genius.com, 90 million Apple Music subscribers, and countless other music fans wherever they connect across the internet.\u003c/p\u003e\n\n\u003cp\u003eNo technology is perfect and Genius believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. This program focuses on the Genius.com website and apps, which power the largest lyrics community in the world. We are excited for you to participate as a security researcher in our vulnerability disclosure program. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eSafe testing rules\u003c/h2\u003e\n\n\u003cp\u003eBy default, Genius operates as a wiki that anyone can edit. When testing vulnerabilities, you're welcome to test all parts of the site, but please only edit songs, albums and artists that you yourself have created. Do not add \"real\" artists (like Beyoncé or Taylor Swift) to any of your song pages, and don't make any edits to song pages or other resources that real users have created.\u003c/p\u003e\n\n\u003cp\u003eAdditionally, please do not DOS our site. Use sensible delays and limits for any fuzzing operation, and try not to exceed 5 simultaneous connections per researcher.\u003c/p\u003e","industryTagId":"ef2b9ee7-7f73-4978-9530-ad18bbf3f902","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Genius not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Genius, you can report it to Genius. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eAll targets are accessible via the public internet. The mobile apps can be downloaded from the Apple App Store and the Google Play Store. \u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eSelf signup\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cp\u003eWe are interested in hearing about any security flaw. This could include, but is not limited to:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAnything that leaks personal user data, e.g. emails, passwords, content a user has set to private or deleted.\u003c/li\u003e\n\u003cli\u003eAccessing someone's account without their knowledge.\u003c/li\u003e\n\u003cli\u003eBug exposing a way to perform an action on behalf of another user.\u003c/li\u003e\n\u003cli\u003eChanging a user's settings without their knowledge.\u003c/li\u003e\n\u003cli\u003eChanging values of any site wide data that fall outside of the scope of your permissions. Because Genius is a crowd-sourced website, many parts of the website are editable by all users.\u003c/li\u003e\n\u003cli\u003eProgrammatically deleting images that don't belong to you.\u003c/li\u003e\n\u003cli\u003eCross-site scripting, including reflected or stored XSS that could be used to compromise another user's account e.g. via a link.\u003c/li\u003e\n\u003cli\u003eIssues with authentication, voting, or comments\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDenial-of-service vulnerabilities\u003c/li\u003e\n\u003cli\u003ePrototype pollution unless proven exploitable / proven security impact\u003c/li\u003e\n\u003cli\u003eVendor compromise / supply chain attacks (e.g. a bug that requires a third-party API or library to act maliciously)\u003c/li\u003e\n\u003cli\u003eSelf-XSS \u003c/li\u003e\n\u003cli\u003eContent \"injection\" of harmless HTML elements that do not cause a software security impact, e.g. \u003ccode\u003ea\u003c/code\u003e links or \u003ccode\u003eh1\u003c/code\u003e elements. We maintain a whitelist of allowed HTML elements \u0026amp; attributes, including links, images and header elements, available here: https://genius.com/Genius-formatting-and-markdown-guide-annotated. Any injection of elements on this whitelist will be marked Not Applicable.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e for clarification before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"4a465403-24e9-4ab7-8091-ee399c815085","name":"In Scope Targets","targets":[{"id":"4eead904-ecd6-47ab-8c3b-fe5389926e0b","uri":"https://genius.com/signup","name":"Genius.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"83a69617-4f94-4b1d-a300-64d50808c555","sortOrder":0},"sortOrder":0,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"4eead904-ecd6-47ab-8c3b-fe5389926e0b"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"4eead904-ecd6-47ab-8c3b-fe5389926e0b"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"4eead904-ecd6-47ab-8c3b-fe5389926e0b"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"4eead904-ecd6-47ab-8c3b-fe5389926e0b"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"4eead904-ecd6-47ab-8c3b-fe5389926e0b"}],"recentChangeFlags":null},{"id":"379ffb29-3942-4066-bcae-960714fb94fb","uri":"https://play.google.com/store/apps/details?id=com.genius.android","name":"Genius Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0e1e4421-9c79-4ec0-8d01-31ba10ac49be","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"379ffb29-3942-4066-bcae-960714fb94fb"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"379ffb29-3942-4066-bcae-960714fb94fb"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"379ffb29-3942-4066-bcae-960714fb94fb"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"379ffb29-3942-4066-bcae-960714fb94fb"}],"recentChangeFlags":null},{"id":"0aa19bff-a0a0-438e-94ae-eeedf413a3af","uri":"https://apps.apple.com/us/app/genius-song-lyrics-finder/id709482991","name":"Genius iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"56661e49-9b80-4bdb-9a01-a2e37ad6b1eb","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"0aa19bff-a0a0-438e-94ae-eeedf413a3af"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"0aa19bff-a0a0-438e-94ae-eeedf413a3af"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"0aa19bff-a0a0-438e-94ae-eeedf413a3af"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"0aa19bff-a0a0-438e-94ae-eeedf413a3af"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"ccab6e09-7297-4897-8ea1-33c5b80f048e","code":"Genius-VDP","state":"in_progress","endsAt":null,"bountyId":"a15dd0b7-2437-47d2-bf05-96b68daa3807","startsAt":"2024-09-11T22:35:48Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Entertainment","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/bc94/2524/8372f083/33454c4dc28491655ec16188cf173cfb_genius_round_large.png","logoBackgroundColor":"#ffff64","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-09-11T22:35:48.512Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/Genius-VDP","changelogs":"/engagements/Genius-VDP/changelog","submissions":null,"announcements":"/engagements/Genius-VDP/announcements","hallOfFame":"/engagements/Genius-VDP/hall_of_fames","crowdstream":"/engagements/Genius-VDP/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/Genius-VDP/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=Genius-VDP\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/Genius-VDP/engagement_subscribers","engagementChangelogsUrl":"/engagements/Genius-VDP/changelog","publishedAt":"2026-06-30T18:59:38.197Z","engagementChangelogUrl":"/engagements/Genius-VDP/changelog/af9ccf7e-a1a6-4a58-bdab-6ebfee0ca61b","createUserFeedbacksUrl":"/engagements/Genius-VDP/feedbacks","engagementCrowdstreamUrl":"/engagements/Genius-VDP/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}