{"id":"0cbe41f4-1a15-4efa-a60e-65b338052dd6","engagementId":"24b48dd2-2a10-48c3-bbd1-aadb30c69f09","data":{"brief":{"id":"67da28e1-1bec-4975-a797-7deab881b290","name":"Acorns Grow, Inc.","tagline":"Acorns is a smart money app and debit card that helps kids grow their money skills — and their money — while they grow up.","description":"\u003cp\u003eOur mission is to look after the financial best interests of the up-and-coming, so we build tools that make investing, saving and earning money easy. Because growing wealth shouldn’t just be for the few. We promise our more than 3,000,000 customers serious security. Thank you for helping us stand by that promise by exposing our vulnerabilities, so that anyone can have a chance at a brighter future.\u003c/p\u003e\n\n\u003cp\u003eOur Acorns Security Analysts are committed to helping our researchers be successful in our program! We are determined to work with you to understand and attempt to resolve the issue quickly (confirming the report within 2 days of submission). \u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Acorns not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eCredentials\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eSelf Signup - Please register using your \u003ccode\u003e@bugcrowdninja.com\u003c/code\u003e email address.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eQualities of a Good Report\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDetailed explanation and proof of concept for the bug\u003c/li\u003e\n\u003cli\u003eDescription of real-world impact/exploitation of the bug\u003c/li\u003e\n\u003cli\u003eBrowser and App version (where applicable)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny type of disclosure or account access on our customers sensitive information\u003c/li\u003e\n\u003cli\u003eBroken Authentication mechanism \u003c/li\u003e\n\u003cli\u003eBroken Authorization\u003c/li\u003e\n\u003cli\u003eXSS\u003c/li\u003e\n\u003cli\u003eCSRF\u003c/li\u003e\n\u003cli\u003eSQLi\u003c/li\u003e\n\u003cli\u003eRedirects \u003c/li\u003e\n\u003cli\u003eRCE\u003c/li\u003e\n\u003cli\u003eAPI Issues \u003c/li\u003e\n\u003cli\u003eMFA \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eIneligible Reports\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eReports of issues without a proof of concept or clear path to exploitation. This includes submitting vulnerability scan reports.  You may still report these, but they will not be eligible for a monetary reward without a proof of concept.\u003c/li\u003e\n\u003cli\u003eFindings from applications or systems not listed in the ‘Targets’ section\u003c/li\u003e\n\u003cli\u003eTest page(s) exposed (This is a test environment. Pages are known to be available).\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; \u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; \u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy;\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e for clarification before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"f87cb44d-3bb7-49f7-91f7-2b13062c35fc","name":"Acorns Targets","targets":[{"id":"36ab7cc3-5c6a-4bd3-b1af-4832c9ad019c","uri":"https://acorns.com/","name":"*.acorns.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c012baf1-28fe-49b7-a6c2-e905be6920b5","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"36ab7cc3-5c6a-4bd3-b1af-4832c9ad019c"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"36ab7cc3-5c6a-4bd3-b1af-4832c9ad019c"}],"recentChangeFlags":null},{"id":"a756cf37-e6a8-4ecb-aceb-ef47452e880b","uri":"https://apps.apple.com/us/app/acorns-invest-spare-change/id883324671","name":"Acorns for iOS","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ca9478c2-7208-46be-ae9d-87ffb049a8dd","sortOrder":0},"sortOrder":0,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"a756cf37-e6a8-4ecb-aceb-ef47452e880b"}],"recentChangeFlags":null},{"id":"b467ca53-818a-4110-9272-099a2740f4d1","uri":"https://graphql.acorns.com","name":"https://graphql.acorns.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8ba40edb-4519-4df9-be0e-2b32e5a8ca1e","sortOrder":0},"sortOrder":0,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"b467ca53-818a-4110-9272-099a2740f4d1"}],"recentChangeFlags":null},{"id":"3c450ad5-8ef0-4576-85a1-9b9871b9a26c","uri":"https://play.google.com/store/apps/details?id=com.acorns.android\u0026hl=en_US\u0026gl=US","name":"Acorns for Android","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"50701aaf-5073-4dbf-95ac-1c3224e164c5","sortOrder":0},"sortOrder":0,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"3c450ad5-8ef0-4576-85a1-9b9871b9a26c"}],"recentChangeFlags":null},{"id":"213d4931-967e-4a29-8a56-9b016ecb8cfb","uri":"https://www.pixpay.fr/","name":"https://www.pixpay.fr/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b90c53ad-cab3-43ba-b162-28b7b3f66f0f","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"aa4b5483-4cf8-4553-9c84-1862cc39bc22","p1MaxCents":400000,"p1MinCents":100000,"p2MaxCents":175000,"p2MinCents":40000,"p3MaxCents":65000,"p3MinCents":17500,"p4MaxCents":20000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cul\u003e\n\u003cli\u003eAll subdomains pertaining to Acorns.com \u003c/li\u003e\n\u003cli\u003eAll App Apis\u003c/li\u003e\n\u003cli\u003eAny and all publicly exposed interfaces owned by Acorns that lead to system exploitation or sensitive information disclosure \u003c/li\u003e\n\u003cli\u003eAndroid and IOS App testing \u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":1000,"max":4000},"2":{"min":400,"max":1750},"3":{"min":175,"max":650},"4":{"min":100,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"59d33fe8-be7a-42d9-bdb7-3978e281a11b","name":"Out of Scope","targets":[{"id":"5978250d-0fc0-45f3-a853-f9330cabf64d","uri":"","name":"share.acorns.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3dacb37d-6a74-4b7e-9ea2-d48be505dc21","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"1327302b-c059-487d-80c0-4d8f92e54447","uri":"","name":"grow.acorns.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6528d551-409a-4368-b6f7-9b5b8b79d073","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"3906d779-d158-4440-8ce8-c82bd5ae86bb","uri":"","name":"store.acorns.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"af1ff6d5-f7fd-487b-9706-e7d17b443655","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cul\u003e\n\u003cli\u003eRate limiting on endpoints\u003c/li\u003e\n\u003cli\u003eAny attack that needs any type of social engineering tactic (need access to customer email etc...)\u003c/li\u003e\n\u003cli\u003eDenial of Service Attacks\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"24b48dd2-2a10-48c3-bbd1-aadb30c69f09","code":"acorns","state":"in_progress","endsAt":null,"bountyId":"b19cd4d8-98a5-40d6-b0ba-f30d925f3206","startsAt":"2015-11-23T18:46:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/5269/3b42/d33c1aec/1ff80bd7f0fc20cf0fd4112371b8104e_Acorns_Square-01__1_.png","logoBackgroundColor":"#74c947","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2015-11-23T18:46:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/acorns","changelogs":"/engagements/acorns/changelog","submissions":null,"announcements":"/engagements/acorns/announcements","hallOfFame":"/engagements/acorns/hall_of_fames","crowdstream":"/engagements/acorns/crowdstream"},"announcementsCount":7,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/acorns/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":"updated","userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=acorns\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/acorns/engagement_subscribers","engagementChangelogsUrl":"/engagements/acorns/changelog","publishedAt":"2026-10-01T17:54:49.265Z","engagementChangelogUrl":"/engagements/acorns/changelog/0cbe41f4-1a15-4efa-a60e-65b338052dd6","createUserFeedbacksUrl":"/engagements/acorns/feedbacks","engagementCrowdstreamUrl":"/engagements/acorns/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}