{"id":"c757b445-44cb-4d84-8bb1-e201aad31872","engagementId":"2fe7230b-76c4-4ac7-937b-394661dcca5b","data":{"brief":{"id":"063bd5e1-9ba4-4c59-b6af-050434337ac6","name":"Afterpay Bug Bounty Program","tagline":"Keeping Afterpay secure for our customers and merchants.","description":"\u003cp\u003eThis program is part of Block, Inc.  Please note that the scope of this program encompasses Afterpay services only. Vulnerabilities discovered in Block products or services should be reported to the relevant Block, Inc programs:\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/cashapp\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCash App\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/square\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSquare\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/tidal-bugbounty?preview=f39b37c04ea03ee111302f7ae385f67c\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTidal\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/engagements/blockopensource\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBlock Open Source\u003c/a\u003e\u003c/p\u003e\n\n\u003ch2\u003eAbout Afterpay\u003c/h2\u003e\n\n\u003cp\u003eAfterpay is transforming the way we pay by allowing anyone to buy products immediately and pay over time - enabling simple, transparent and responsible spending. We are on a mission to power an economy in which everyone wins.\u003c/p\u003e\n\n\u003cp\u003eAfterpay is offered by thousands of the world’s favourite retailers and used by millions of active global customers. Afterpay is currently available in Australia, Canada, New Zealand, the United States and the United Kingdom (where it is known as Clearpay). Afterpay is a wholly owned subsidiary of Block, Inc. (NYSE: SQ).\u003c/p\u003e\n\n\u003ch2\u003eGetting Started\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eLimit your testing to avoid accessing, destroying or otherwise negatively impacting Afterpay customers and merchants data.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eEnsure you understand the targets, scopes and exclusions below\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAfterpay functionality is accessible through our mobile apps, or website: \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://play.google.com/store/apps/details?id=com.afterpaymobile\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://play.google.com/store/apps/details?id=com.afterpaymobile\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://apps.apple.com/au/app/afterpay-shop-now-pay-later/id1230286588\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://apps.apple.com/au/app/afterpay-shop-now-pay-later/id1230286588\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.afterpay.com/en-US\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.afterpay.com/en-US\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://portal.afterpay.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://portal.afterpay.com\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eYou can read about Afterpay’s integration methods and APIs at \u003ca href=\"https://developers.afterpay.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developers.afterpay.com/\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWe recommend performing testing within the Sandbox environment using the API keys provided in scope section of this program brief. You can also provision yourself a customer account in this environment.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eSubmission Quality \u003c/h2\u003e\n\n\u003cp\u003eWhen writing a submission, you should provide enough information that allows us to reproduce and gain an understanding of the issue, ideally without needing to ask for further clarification. The advice below should be followed to limit misunderstandings and the need for follow-up questions which slow down the triaging process:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCheck our ‘Program Scope’ section before you begin writing your report to ensure the issue you are reporting is in-scope for the program. We make no guarantees that findings for out-of-scope targets will be rewarded\u003c/li\u003e\n\u003cli\u003eProvide as many details as possible for our team to assist them with reproducing the issue. Screenshots may be helpful here.\u003c/li\u003e\n\u003cli\u003ePlease include your understanding of the security impact of the issue, even if you feel that it may be incomplete. In some cases, it may not be possible to have all of the context on the impact of a bug. If you’re unsure of the direct impact, but feel you may have found something interesting, feel free to submit a detailed report and ask.\u003c/li\u003e\n\u003cli\u003eWhilst adhering to security best practices is important, all submissions must demonstrate some level of security impact to be eligible for a reward. Think about the attack scenario and how the issue can be exploited (even if the full extent of the issue is uncertain).\u003c/li\u003e\n\u003cli\u003eA vulnerability must be verifiable and reproducible for us to be considered in-scope.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eProgram Scope\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eAny finding that is not listed as in scope is still encouraged to be reported via this program. These reports will be rewarded at the discretion of the Afterpay Security Team.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eAll mobile client related vulnerabilities/exploits must be proven to work in the latest version of our mobile application.\u003c/em\u003e\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003ePlease don't submit multiple reports for the same issue impacting both Production \u0026amp; Sandbox environments. Our Sandbox environment is our non-production equivalent, so we expect the same issues to exist in both environments.\u003c/p\u003e\n\n\u003cp\u003eRewards for findings in third party software \u0026amp; services used by Afterpay will be reviewed on a case by case basis. There are no guarantees that we will reward these issues, but this will be assessed based on impact.\u003c/p\u003e\n\n\u003ch2\u003eDisclosure Procedures\u003c/h2\u003e\n\n\u003cp\u003eBlock recognizes the important contributions the security research community can make. We do not publicly disclose vulnerabilities by default. We take the security of our services very seriously and monitor their use for indications of a malicious attack. In order to distinguish legitimate security research from malicious attacks against our services, we promise not to bring legal action against researchers who:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eShare with us the full details of any problem found\u003c/li\u003e\n\u003cli\u003eDo not disclose the issue to others until we’ve had a reasonable time to address it and disclosure has been approved by us\u003c/li\u003e\n\u003cli\u003eDo not intentionally harm the experience or usefulness of the service to others\u003c/li\u003e\n\u003cli\u003eNever attempt to view, modify, access, disclose, exfiltrate, use or damage data belonging to Block, its customers, or others\u003c/li\u003e\n\u003cli\u003eDo not attempt a denial-of-service attack\u003c/li\u003e\n\u003cli\u003eDo not perform any research or testing in violation of the law\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eDisclosure outside of Bugcrowd\u003c/h2\u003e\n\n\u003cp\u003eIf you would like to report a security vulnerability to us outside of the Bugcrowd platform, please use the contact email found in our \u003ca href=\"https://afterpay.com/.well-known/security.txt\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esecurity.txt file\u003c/a\u003e. We do not offer rewards for responsible disclosure findings submitted outside of Bugcrowd.\u003c/p\u003e","industryTagId":"1bf3970a-395b-4456-b261-d04dab482af2","targetsOverview":"\u003ch3\u003eAreas of focus / targets\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAfterpay Mobile Apps (iOS \u0026amp; Android)\u003c/li\u003e\n\u003cli\u003eAfterpay Marketing site (afterpay.com)\u003c/li\u003e\n\u003cli\u003eAfterpay Consumer Portal (portal.afterpay.com)\u003c/li\u003e\n\u003cli\u003eMobile API (mobileapi.afterpay.com)\u003c/li\u003e\n\u003cli\u003ePortal API (portalapi.*.afterpay.com)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eWe recommend that testing is performed within our sandbox environment. Support will not be provided to reverse/refund/cancel any Afterpay transactions completed via third party merchants in our Production environment.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003ePlease see the documentation available at:\u003cbr\u003e\n\u003ca href=\"https://developers.afterpay.com/afterpay-online/docs/test-environment\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developers.afterpay.com/afterpay-online/docs/test-environment\u003c/a\u003e \u003cbr\u003e\n\u003ca href=\"https://developers.afterpay.com/afterpay-online/docs/postman-collection\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developers.afterpay.com/afterpay-online/docs/postman-collection\u003c/a\u003e\u003c/p\u003e\n\n\u003cp\u003eThese links will provide you with instructions on how to interact with the Sandbox environment. Sandbox API credentials are provided in the table below.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eKeep in mind that testing for DoS / lack of rate limiting vulnerabilities is out of scope for this program.\u003c/strong\u003e \u003c/p\u003e\n\n\u003cp\u003eUnfortunately, we do not provide test accounts to researchers for accessing our merchant portal at this time.\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eName\u003c/th\u003e\n\u003cth\u003eRegion\u003c/th\u003e\n\u003cth\u003eID\u003c/th\u003e\n\u003cth\u003eAPI Key\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eBug Bounty Program AU Sandbox 1\u003c/td\u003e\n\u003ctd\u003eAU\u003c/td\u003e\n\u003ctd\u003e43181\u003c/td\u003e\n\u003ctd\u003e984fa120a16b5b8a3f6d674ce64b030c010153ff3ac7d2c144bd4041c4fb5c44baaa623f4a1d22ef1dc0048b4c0c142d4f5abd381a21b59057a5ab7b7701ca93\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBug Bounty Program AU Sandbox 2\u003c/td\u003e\n\u003ctd\u003eAU\u003c/td\u003e\n\u003ctd\u003e43483\u003c/td\u003e\n\u003ctd\u003e3923852fa665cd3ddb2bffaac9d828da4e2d03c371a6af9c8d7a00b2a40fb005cd86c91021b004c11b3a739b1b70f538cd4de6b75883b4b303379a2c5893dda7\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBug Bounty Program CA Sandbox\u003c/td\u003e\n\u003ctd\u003eCA\u003c/td\u003e\n\u003ctd\u003e100203785\u003c/td\u003e\n\u003ctd\u003ea7f9395b115dae49d1ff2b776e21be55920c4b16b800f8a8d67c519860f28586cd2f1309db0cef3b3d8896a1430f422d7df62e2ac5bc64ebc1966e65f26c21a7\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBug Bounty Program US Sandbox\u003c/td\u003e\n\u003ctd\u003eUS\u003c/td\u003e\n\u003ctd\u003e100203697\u003c/td\u003e\n\u003ctd\u003e80f50c878828e2daad38bbe986d5373638926ccfd9ebfcd8a9b754d1720014104757fbdf0bf8609acf1d0258852be8f2f43a2acc6616ae6080e54f5a9a032395\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBug Bounty Program UK Sandbox 1\u003c/td\u003e\n\u003ctd\u003eUK\u003c/td\u003e\n\u003ctd\u003e400248332\u003c/td\u003e\n\u003ctd\u003e15850c90f4362e53a38ceba5eb874f379745016fbd6fc74c948c0be71b84fc041cb212d93f19aef423b5fb7f3c4b8057d04f465339ddba93557ea9210b8aeb97\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBug Bounty Program UK Sandbox 2\u003c/td\u003e\n\u003ctd\u003eUK\u003c/td\u003e\n\u003ctd\u003e400248333\u003c/td\u003e\n\u003ctd\u003e42febb9dcd41368bcb0b5ef9a460fe3698b13d8a98d15c763caa14ed07615f62c775a53845a04f7437ed54caf7a58e6bee2301fa35e86e4c3d80adef8801fb8\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ch3\u003eFinding Exclusions\u003c/h3\u003e\n\n\u003cp\u003e\u003cstrong\u003eThe following finding types are excluded from the bounty:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eLack of rate limiting controls \u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eOpen redirect vulnerabilities\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eSecurity vulnerabilities on merchant sites that accept Afterpay as a payment method\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAny target that is covered under another Block bug bounty program (e.g. Square, Square Open Source, Cash App, Tidal)\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eSocial engineering or phishing attempts against employees\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eInconsistencies related to our fraud prevention tooling\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDescriptive error messages (e.g. stack traces, application or server errors, version disclosure)\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eClickjacking\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eLogout Cross-Site Request Forgery (logout CSRF)\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eContent Spoofing\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ePresence of application or web browser ‘autocomplete’ or ‘save password’ functionality\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eLack of Secure/HTTPOnly flags on non-sensitive Cookies\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eLack of Security speed bump when leaving the site\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eLogin or Forgot Password page brute force\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eUsername / email enumeration.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eMissing or misconfigured HTTP security headers\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSSL/TLS Issues without a demonstrable impact, such as:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eSSL weak/insecure cipher suites\u003c/li\u003e\n\u003cli\u003ePadding oracle attacks\u003c/li\u003e\n\u003cli\u003eSSL Forward secrecy not enabled\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eSelf-XSS \u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eKnown vulnerabilities in libraries that Afterpay uses, unless you can prove exploitability\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eMissing or incorrect SPF records of any kind.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eMissing or incorrect DMARC records of any kind.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eInformation disclosure of non-confidential information (e.g. merchant IDs, merchant store locations, etc.)\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eThe ability to upload/download viruses or malicious files to the platform\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eEmail bombing/flooding/lack of rate limiting\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eBroken links hosted on our website\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eLeaked user credentials found online\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eCache poisoning resulting in DoS\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"f19c0c9c-4e14-42a5-ab04-d1b1b993db1d","name":"████████","targets":[{"id":"401acb02-ba2b-4728-b1eb-d4959110c082","uri":null,"name":"████████████████","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"82442f66-cf8f-4b34-9e9e-77c6767c9484","sortOrder":0},"sortOrder":0,"tags":[{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"401acb02-ba2b-4728-b1eb-d4959110c082"},{"id":"7dd1f8f1-9bca-4248-84ac-86ec1127bfb5","name":"Google Maps API","targetId":"401acb02-ba2b-4728-b1eb-d4959110c082"}],"recentChangeFlags":null},{"id":"93c856de-75d7-4582-8865-1fe388d0da10","uri":null,"name":"████████████████████","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7263d891-590c-4c5b-906e-caaf16b92b51","sortOrder":0},"sortOrder":0,"tags":[{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"93c856de-75d7-4582-8865-1fe388d0da10"},{"id":"7dd1f8f1-9bca-4248-84ac-86ec1127bfb5","name":"Google Maps API","targetId":"93c856de-75d7-4582-8865-1fe388d0da10"}],"recentChangeFlags":null},{"id":"397d857a-e21d-44b7-818b-12946a53aca6","uri":null,"name":"███████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9fe921a3-2d8c-4796-a0e7-d9c16d383c0d","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"397d857a-e21d-44b7-818b-12946a53aca6"},{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"397d857a-e21d-44b7-818b-12946a53aca6"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"397d857a-e21d-44b7-818b-12946a53aca6"}],"recentChangeFlags":null},{"id":"d67090d4-d728-4778-9b15-b949a6e465bc","uri":null,"name":"██████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7b2f0d54-06e5-4776-8dfe-c75975c07097","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"}],"recentChangeFlags":null},{"id":"9906e871-0093-43cd-9420-6a49c9fdede2","uri":null,"name":"██████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6ead3c05-f596-4af9-8e4b-7f8482cbcf7b","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"9906e871-0093-43cd-9420-6a49c9fdede2"}],"recentChangeFlags":null},{"id":"c3216763-f43a-4769-8603-a81647100e80","uri":null,"name":"████████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d8eba52c-0a24-4d0b-a8e0-1b9a02ee315f","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"c3216763-f43a-4769-8603-a81647100e80"},{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"c3216763-f43a-4769-8603-a81647100e80"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"c3216763-f43a-4769-8603-a81647100e80"}],"recentChangeFlags":null},{"id":"80aa5539-97fa-4316-a274-00cce2a4726c","uri":null,"name":"███████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a1deef3a-c92a-418d-b362-8cb0ea2ad4e4","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"26e7e9da-1ca9-4352-bccc-3e2c1f2bb0f2","p1MaxCents":500000,"p1MinCents":250000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":50000,"p3MinCents":25000,"p4MaxCents":20000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2500,"max":5000},"2":{"min":1000,"max":1500},"3":{"min":250,"max":500},"4":{"min":100,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"bd56b1bd-2077-4513-8ed5-5b7a8b83fa01","name":"████████","targets":[{"id":"d9bdde48-b903-4b3d-9448-287a33195bb7","uri":null,"name":"████████████████","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e5dc77b3-b5c3-4d12-9cbb-640c3d834f35","sortOrder":0},"sortOrder":0,"tags":[{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"d9bdde48-b903-4b3d-9448-287a33195bb7"}],"recentChangeFlags":null},{"id":"6f63f400-a377-403e-9667-829cf0e6e106","uri":null,"name":"████████████████████","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cd05183b-7ee0-4043-b75b-a9f1c3e71898","sortOrder":0},"sortOrder":0,"tags":[{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"6f63f400-a377-403e-9667-829cf0e6e106"}],"recentChangeFlags":null},{"id":"80f466f3-a0e5-4d86-9100-7be6ff193949","uri":null,"name":"██████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a2f21b12-a991-4bed-bb54-a2ea21d7e0df","sortOrder":0},"sortOrder":0,"tags":[{"id":"0ce93ddf-31a4-4663-b1ca-9a1ac7da35a3","name":"Stripe","targetId":"80f466f3-a0e5-4d86-9100-7be6ff193949"}],"recentChangeFlags":null},{"id":"7706b2b0-2e65-44c2-85f8-992ae94f12be","uri":null,"name":"████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1abbf89a-d7a6-4109-83e1-b7515313dc95","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"39203b0b-f7a7-41a5-b5d3-541ad23ff17b","uri":null,"name":"███████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5b1c8a91-41aa-48a3-a476-5124dd6c8d9e","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"39203b0b-f7a7-41a5-b5d3-541ad23ff17b"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"39203b0b-f7a7-41a5-b5d3-541ad23ff17b"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"39203b0b-f7a7-41a5-b5d3-541ad23ff17b"}],"recentChangeFlags":null},{"id":"df9b4f87-142b-4a64-aa60-cea5fdfbec41","uri":null,"name":"█████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"efbb11e7-e164-44c3-9883-d0a134e22835","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7dcd16f4-0c99-40a8-b791-c3f7fe97631b","uri":null,"name":"██████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c96e48a5-509c-464b-9135-b823a56445e5","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"3e0b330c-edb8-450d-ac25-965adca31df3","uri":null,"name":"███████████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3749f009-4853-41e3-ba09-820719871a95","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"92e581c6-9bc0-497a-a7c0-57afe22af7bb","uri":null,"name":"████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"80058c0e-af61-441e-9725-4007282318aa","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"92e581c6-9bc0-497a-a7c0-57afe22af7bb"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"92e581c6-9bc0-497a-a7c0-57afe22af7bb"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"26e7e9da-1ca9-4352-bccc-3e2c1f2bb0f2","p1MaxCents":500000,"p1MinCents":250000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":50000,"p3MinCents":25000,"p4MaxCents":20000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2500,"max":5000},"2":{"min":1000,"max":1500},"3":{"min":250,"max":500},"4":{"min":100,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"57e760f0-e70c-45a2-9196-ba15b644ea4c","name":"████████████","targets":[{"id":"16e70563-3fa0-449e-b92c-2450c2cc7974","uri":null,"name":"████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fcfc84e9-f6b5-4b6c-ad3a-302f65dd9e10","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"aeeb10de-7f6d-4117-9486-15484596dfd0","uri":null,"name":"███████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5c603b74-7e60-4f11-a079-91433a49ed27","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"afab4e6c-9bff-4d7a-9b5b-5de50837f509","uri":null,"name":"███████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b1c8ae06-8576-49af-a611-0faeb9efb171","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"2fe7230b-76c4-4ac7-937b-394661dcca5b","code":"afterpay","state":"in_progress_paused","endsAt":null,"bountyId":"da25f60e-161b-4371-8b2a-37c3dac6eefe","startsAt":"2023-01-17T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"eCommerce","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/engagement_brief_logos/engagement_brief/logo/063bd5e1-9ba4-4c59-b6af-050434337ac6/31a5c1e5-7a97-4815-8278-481b5ebc7e2b.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":"This engagement is paused until further notice and will not reopen.","lastTransitionAt":"2026-10-01T05:59:18.229Z","cancellationReason":null,"statusLabel":"In progress paused","routesPaths":{"brief":"/engagements/afterpay","changelogs":"/engagements/afterpay/changelog","submissions":null,"announcements":"/engagements/afterpay/announcements","hallOfFame":"/engagements/afterpay/hall_of_fames","crowdstream":null},"announcementsCount":3,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":null,"methodologyUrl":null,"progressPercentage":0,"badgeVariant":"updated","userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=afterpay\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/afterpay/engagement_subscribers","engagementChangelogsUrl":"/engagements/afterpay/changelog","publishedAt":"2026-10-01T05:59:18.269Z","engagementChangelogUrl":"/engagements/afterpay/changelog/c757b445-44cb-4d84-8bb1-e201aad31872","createUserFeedbacksUrl":"/engagements/afterpay/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}