{"id":"adabd0e6-d949-4c09-b121-e18ed3e6e19d","engagementId":"0e61a062-7d4a-4910-a643-f4fa2a618c4d","data":{"brief":{"id":"3615479a-97a2-4c76-bcf7-36ed6694da61","name":"Adore Me Vulnerability Disclosure Engagement ","tagline":"Adore Me believes fashion can be a force for good, for everyone.","description":"\u003cp\u003eAdore Me takes its responsibility to protect customer experiences seriously, and we believe that working with skilled security researchers across the globe is a critical component to our process.  We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web apps. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Adore Me not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before submitting.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess/Credentials\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eTarget is accessible via public internet. When testing, please use your @bugcrowdninja.com email address. Submissions that are made with non-@bugcrowdninja email addresses will be considered out of scope. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eClickjacking on non-sensitive pages\u003c/li\u003e\n\u003cli\u003eAttacks requiring MITM or physical access to a user's device\u003c/li\u003e\n\u003cli\u003eAny activity that could lead to the disruption of our service (DoS)\u003c/li\u003e\n\u003cli\u003eMissing best practices in Content Security Policy\u003c/li\u003e\n\u003cli\u003eResults from automated tools without any manual confirmation\u003c/li\u003e\n\u003cli\u003eLogin/Logout CSRF\u003c/li\u003e\n\u003cli\u003eLack of Secure/HTTPOnly flags on non-sensitive Cookies\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support \u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"d8ed7fd2-eb45-4a61-a0b9-3ea3d3fe9cc1","name":"In Scope Targets","targets":[{"id":"418d5388-4a5b-4332-9628-22658feb6d7c","uri":"https://www.adoreme.com/","name":"*.adoreme.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e345943d-d277-4272-9125-5c1165d76de3","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"418d5388-4a5b-4332-9628-22658feb6d7c"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"418d5388-4a5b-4332-9628-22658feb6d7c"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"418d5388-4a5b-4332-9628-22658feb6d7c"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"418d5388-4a5b-4332-9628-22658feb6d7c"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"418d5388-4a5b-4332-9628-22658feb6d7c"}],"recentChangeFlags":null},{"id":"3e7e4c13-c37b-46ca-9149-b748f53f528b","uri":"https://apps.apple.com/us/app/adore-me-designer-lingerie/id661053119","name":"Adore Me iOS app","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b94e25ff-f5f6-4ca1-ba0f-3b406c729460","sortOrder":0},"sortOrder":0,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"3e7e4c13-c37b-46ca-9149-b748f53f528b"}],"recentChangeFlags":null},{"id":"14a6a263-3119-421c-aa45-bb0304aeb493","uri":"https://play.google.com/store/apps/details?id=com.adoreme.android\u0026hl=en_IN\u0026gl=US\u0026pli=1","name":"Adore Me Android app","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"51b09a0b-79f1-4273-a730-857588a792ba","sortOrder":0},"sortOrder":0,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"14a6a263-3119-421c-aa45-bb0304aeb493"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"0e61a062-7d4a-4910-a643-f4fa2a618c4d","code":"adoreme-vdp","state":"in_progress","endsAt":null,"bountyId":"e207f14e-de24-446a-ba72-f3ef62dcc9ee","startsAt":"2023-08-03T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/7d2d/5bea/cd0e00d7/903f0a12556b9f3bb33ce235a031401b_AM.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2023-08-03T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/adoreme-vdp","changelogs":"/engagements/adoreme-vdp/changelog","submissions":null,"announcements":"/engagements/adoreme-vdp/announcements","hallOfFame":"/engagements/adoreme-vdp/hall_of_fames","crowdstream":"/engagements/adoreme-vdp/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/adoreme-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=adoreme-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/adoreme-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/adoreme-vdp/changelog","publishedAt":"2025-10-07T11:50:34.097Z","engagementChangelogUrl":"/engagements/adoreme-vdp/changelog/adabd0e6-d949-4c09-b121-e18ed3e6e19d","createUserFeedbacksUrl":"/engagements/adoreme-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/adoreme-vdp/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}