{"id":"13ed2c66-d910-42d7-a8ea-ec7d8d4145fc","engagementId":"4cc181bd-caf5-4c41-b285-46d3d096c4a5","data":{"brief":{"id":"f9a4b82f-85b7-43ad-ab04-2510c1b18b5b","name":"ANZ Responsible Disclosure Program","tagline":"Submit your findings to ANZ's responsible disclosure program","description":"\u003cp\u003eANZ takes the security of our systems and customer data seriously. The responsible disclosure of vulnerabilities helps ensure the security and privacy of ANZ and our customers. We value and support the work undertaken by the security research community and appreciate it when researchers take the time to report potential security vulnerabilities to us.\u003c/p\u003e\n\n\u003cp\u003ePlease review the program contents before submitting your findings.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"b3d6ff0b-119e-4f5b-9c38-ee13f125fc52","targetsOverview":"\u003cp\u003eANZ uses a number of third-party providers and services – including a number hosted on subdomains of anz.com that will be considered Out-of-Scope for this program. We cannot authorise security testing against systems that do not belong to us but strongly suggest reporting issues identified within these services to the third-party directly. However, if you believe an issue with one of our third-party service providers is the result of ANZ's misconfiguration or insecure usage of that service (or you've reported an issue affecting many customers of the service that you believe ANZ can temporarily mitigate without stopping usage of the service while a fix is implemented upstream), we'd appreciate your report regarding the issue.\u003c/p\u003e\n\n\u003cp\u003eTesting is only authorised on the targets listed as in scope. Any app/service/domain/property of ANZ not listed in the targets section is out of scope. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to ANZ, we would appreciate it if you report it as well.  \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not perform Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) attacks.\u003c/li\u003e\n\u003cli\u003eDo not in any way attack our customers or end users, or use stolen/breached user credentials.\u003c/li\u003e\n\u003cli\u003eDo not access, modify, delete or store ANZ or our customers' data.\u003c/li\u003e\n\u003cli\u003eDo not conduct non-technical attacks such as social engineering, phishing, or unauthorised access to Infrastructure.\u003c/li\u003e\n\u003cli\u003eResearchers should not pursue post-exploitation unless explicitly approved.\u003c/li\u003e\n\u003cli\u003eTargeted attacks against social media or third party services that ANZ use (LinkedIn, Twitter, etc).\u003c/li\u003e\n\u003cli\u003eAny attempt to modify or destroy information.\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting users of outdated browsers.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eScanning\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe use of automated scanning tools is prohibited.\u003c/li\u003e\n\u003cli\u003eRecursive DNS enumeration should be kept to a minimum.\u003c/li\u003e\n\u003cli\u003eANZ will not accept generic vulnerability scan results without proof of concept or a clear path to exploitation.\u003c/li\u003e\n\u003cli\u003eScanning or brute force attempts on Submission Forms is considered Out-Of-Scope and should not be attempted. You may reach out for approval to do manual testing.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eCredentials\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe use of personal credentials, your own or discovered, for testing purposes is strictly prohibited. This program is set up as an unauthenticated program. If you have any questions regarding this matter, please contact support@bugcrowd.com\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eConfidentiality\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou must treat all information about our systems, staff or customers that comes into your possession or that you otherwise become aware of, which is not publicly available, as strictly confidential and not share or otherwise use it for any purpose other than emailing it to us as a submission as described above.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cstrong\u003ePlease be aware that there are no monetary payments for findings on this program.\u003c/strong\u003e \u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":"\u003ch2\u003eProgram Rules\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll valid reports will be taken seriously by our teams and with this in mind, do give us a reasonable period of time to evaluate the submission and respond accordingly.\u003c/li\u003e\n\u003cli\u003ePlease provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.\u003c/li\u003e\n\u003cli\u003eSubmit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.\u003c/li\u003e\n\u003cli\u003eWhen duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).\u003c/li\u003e\n\u003cli\u003eMultiple vulnerabilities caused by one underlying issue will be treated as one valid report.\u003c/li\u003e\n\u003cli\u003eWhile testing our systems you make every effort not to damage or restrict the availability of products, services or infrastructure.\u003c/li\u003e\n\u003cli\u003eYou do not use a detected vulnerability to obtain more data than necessary for proving the vulnerability.\u003c/li\u003e\n\u003cli\u003eYou agree to securely delete all personal and confidential information obtained during testing.\u003c/li\u003e\n\u003c/ul\u003e"},"scope":[{"id":"85ccfc64-a7ce-4091-8b65-a11bb0236c1b","name":"In Scope","targets":[{"id":"e120be2f-5f33-4fc8-8f28-8c98904a16aa","uri":"https://*.anz.com.au","name":"*.anz.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"80db0dbf-02a1-4feb-ae9b-c8bdb2d3ac21","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"e120be2f-5f33-4fc8-8f28-8c98904a16aa"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"e120be2f-5f33-4fc8-8f28-8c98904a16aa"},{"id":"73ea470f-6fb9-4636-900b-259e5466f37e","name":"Apache httpd","targetId":"e120be2f-5f33-4fc8-8f28-8c98904a16aa"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"e120be2f-5f33-4fc8-8f28-8c98904a16aa"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"e120be2f-5f33-4fc8-8f28-8c98904a16aa"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"e120be2f-5f33-4fc8-8f28-8c98904a16aa"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e120be2f-5f33-4fc8-8f28-8c98904a16aa"},{"id":"d866e8ba-8dcd-4711-a16d-abaccdd975ec","name":"WAF/RASP Bypass","targetId":"e120be2f-5f33-4fc8-8f28-8c98904a16aa"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"e120be2f-5f33-4fc8-8f28-8c98904a16aa"}],"recentChangeFlags":null},{"id":"d2c49307-431b-487f-bac1-cd1b4016ac12","uri":"https://*.anz.com","name":"*.anz.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"158baae8-3159-4a4a-9486-6895b3a0508d","sortOrder":1},"sortOrder":1,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"d2c49307-431b-487f-bac1-cd1b4016ac12"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"d2c49307-431b-487f-bac1-cd1b4016ac12"},{"id":"73ea470f-6fb9-4636-900b-259e5466f37e","name":"Apache httpd","targetId":"d2c49307-431b-487f-bac1-cd1b4016ac12"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"d2c49307-431b-487f-bac1-cd1b4016ac12"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"d2c49307-431b-487f-bac1-cd1b4016ac12"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"d2c49307-431b-487f-bac1-cd1b4016ac12"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d2c49307-431b-487f-bac1-cd1b4016ac12"},{"id":"d866e8ba-8dcd-4711-a16d-abaccdd975ec","name":"WAF/RASP Bypass","targetId":"d2c49307-431b-487f-bac1-cd1b4016ac12"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"d2c49307-431b-487f-bac1-cd1b4016ac12"}],"recentChangeFlags":null},{"id":"b467f3f8-05e9-47ca-988a-e6b735f3dc5a","uri":"https://www.anz.co.nz","name":"anz.co.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"09da4480-af37-472d-87a2-d45135eaf1e1","sortOrder":2},"sortOrder":2,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"b467f3f8-05e9-47ca-988a-e6b735f3dc5a"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"b467f3f8-05e9-47ca-988a-e6b735f3dc5a"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"b467f3f8-05e9-47ca-988a-e6b735f3dc5a"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"b467f3f8-05e9-47ca-988a-e6b735f3dc5a"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"b467f3f8-05e9-47ca-988a-e6b735f3dc5a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b467f3f8-05e9-47ca-988a-e6b735f3dc5a"},{"id":"d866e8ba-8dcd-4711-a16d-abaccdd975ec","name":"WAF/RASP Bypass","targetId":"b467f3f8-05e9-47ca-988a-e6b735f3dc5a"}],"recentChangeFlags":null},{"id":"2f1b3282-0f9d-4d96-85d5-be1966c4e183","uri":"https://onlinestore.anz.co.nz","name":"onlinestore.anz.co.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a44530a8-71b1-449e-ab90-4542f7535054","sortOrder":3},"sortOrder":3,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"2f1b3282-0f9d-4d96-85d5-be1966c4e183"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"2f1b3282-0f9d-4d96-85d5-be1966c4e183"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"2f1b3282-0f9d-4d96-85d5-be1966c4e183"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"2f1b3282-0f9d-4d96-85d5-be1966c4e183"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"2f1b3282-0f9d-4d96-85d5-be1966c4e183"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2f1b3282-0f9d-4d96-85d5-be1966c4e183"},{"id":"d866e8ba-8dcd-4711-a16d-abaccdd975ec","name":"WAF/RASP Bypass","targetId":"2f1b3282-0f9d-4d96-85d5-be1966c4e183"}],"recentChangeFlags":null},{"id":"50e13122-4ec3-41bc-ac82-0f542911fa89","uri":"https://open.anz.co.nz","name":"open.anz.co.nz","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"157b6146-ab47-4500-ac21-7e4cf87950c1","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"50e13122-4ec3-41bc-ac82-0f542911fa89"}],"recentChangeFlags":null},{"id":"6da35e6a-a476-45a4-86bd-fad47b77954a","uri":"https://play.google.com/store/apps/details?id=com.anz.lotus\u0026referrer=utm_source%3Downed%26utm_campaign%3Dall_sb_des_fy23q2_testing","name":"ANZ Plus Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3a687c06-3ea1-4d24-8257-fcaf70647f7d","sortOrder":5},"sortOrder":5,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"6da35e6a-a476-45a4-86bd-fad47b77954a"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"6da35e6a-a476-45a4-86bd-fad47b77954a"}],"recentChangeFlags":null},{"id":"b8fc8265-2584-4355-8f74-8c1900d4abcb","uri":"https://apps.apple.com/au/app/anz-plus/id1495738612","name":"ANZ Plus iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3fdcba41-9992-473e-a901-6d77e292898f","sortOrder":6},"sortOrder":6,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"b8fc8265-2584-4355-8f74-8c1900d4abcb"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"b8fc8265-2584-4355-8f74-8c1900d4abcb"}],"recentChangeFlags":null},{"id":"9b52ec69-945d-4fa4-af73-884aac716c66","uri":"https://apps.apple.com/au/app/anz-australia/id870929663","name":"ANZ Australia iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"779a309b-6fd7-407f-bad9-dd2dbdb58789","sortOrder":7},"sortOrder":7,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"9b52ec69-945d-4fa4-af73-884aac716c66"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"9b52ec69-945d-4fa4-af73-884aac716c66"}],"recentChangeFlags":null},{"id":"1050f476-8cbc-490d-aa34-075597bdbe8c","uri":"https://play.google.com/store/apps/details?id=com.anz.android.gomoney\u0026pcampaignid=web_share","name":"ANZ Australia Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1f327a0e-b5c4-4c7e-961c-9bc8af25e095","sortOrder":8},"sortOrder":8,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"1050f476-8cbc-490d-aa34-075597bdbe8c"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"1050f476-8cbc-490d-aa34-075597bdbe8c"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"24c3c388-9850-49e7-b559-d74970657958","name":"Out of Scope","targets":[{"id":"2844013e-0507-4f09-a47d-77c6ebf10da4","uri":"https://b2b-api.anz.co.nz","name":"b2b-api.anz.co.nz","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e6d06a06-d457-4e57-b0f0-52885b656f72","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"2844013e-0507-4f09-a47d-77c6ebf10da4"}],"recentChangeFlags":null},{"id":"0daf4b5c-2ea2-408a-b210-e9d4a7677177","uri":"https://digital.anz.co.nz","name":"digital.anz.co.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"52df8fff-362b-4ae3-82cd-b59cd18f96f2","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0daf4b5c-2ea2-408a-b210-e9d4a7677177"}],"recentChangeFlags":null},{"id":"d1dafc5e-88c3-404f-aa97-c5ddeca1238f","uri":"https://secure.anz.co.nz","name":"secure.anz.co.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"93c9ab44-44cd-4ec6-956b-e22e9f0d8c94","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d1dafc5e-88c3-404f-aa97-c5ddeca1238f"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"4cc181bd-caf5-4c41-b285-46d3d096c4a5","code":"anz-vdp","state":"in_progress","endsAt":null,"bountyId":"929036e8-1e35-461e-834d-8e81649196c8","startsAt":"2022-08-30T00:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Banking","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/dada/e0d3/8180e6d0/94e09d1d026fb1f6f40a463fc5ce5cd4_ANZ.jpeg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2022-08-30T00:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/anz-vdp","changelogs":"/engagements/anz-vdp/changelog","submissions":null,"announcements":"/engagements/anz-vdp/announcements","hallOfFame":"/engagements/anz-vdp/hall_of_fames","crowdstream":null},"announcementsCount":0,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/anz-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=anz-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/anz-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/anz-vdp/changelog","publishedAt":"2026-05-07T05:33:09.091Z","engagementChangelogUrl":"/engagements/anz-vdp/changelog/13ed2c66-d910-42d7-a8ea-ec7d8d4145fc","createUserFeedbacksUrl":"/engagements/anz-vdp/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}