{"id":"715a1af5-50c4-4cfa-842a-048134e77d84","engagementId":"fbf1be67-bc67-4ddd-82f2-484d63200b4b","data":{"brief":{"id":"44db4066-3ebd-4b60-8ebf-c82a5d3f3974","name":"Arlo Cash Rewards","tagline":"Arlo Cash Rewards Program","description":"\u003ch1\u003eAbout Arlo Cash Rewards Program\u003c/h1\u003e\n\n\u003cp\u003eThis program encourages and rewards contributions by developers and security researchers who help make Arlo’s products more secure. Arlo provides monetary rewards and kudos for qualifying vulnerability submissions to this program. For submissions outside the scope of this program, please submit to the \u003ca href=\"https://www.bugcrowd.com/arlokudos\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eArlo Kudos Rewards Program\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eNETGEAR products have their own Bug Bounty program. Please click the following link to \u003ca href=\"https://www.bugcrowd.com/netgear\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eNETGEAR Cash Rewards Program\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eOnly vulnerabilities found in the latest version of the above are eligible. Targets listed below denote Cloud Infrastructure that support in-scope devices and are included in scope:\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eA note about business impact\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eArlo appreciates the efforts and contributions from the security research community. In order to provide researchers with timely and accurate rewards, Arlo requests that submitters include a statement about perceived impact to arlo, along with the submission details. Not only will this help Arlo reproduce, rate and reward your findings in a timely manner -- it is likely to help improve the severity score of your finding as well!\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003chr\u003e\n\n\u003ch3\u003eOut of Scope:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll Arlo products and properties not explicitly denoted in Targets, excluding High Impact Submissions as described below\u003c/li\u003e\n\u003cli\u003eAll vulnerabilities submitted to the \u003ca href=\"https://bugcrowd.com/netgear\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eNETGEAR Cash Rewards Program\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003ePriority and Reward Guidelines\u003c/h3\u003e\n\n\u003cp\u003eThe Arlo Product Security team, at their sole discretion, determines the nature and impact of the vulnerabilities disclosed including, but not limited to, leveraging CVSS rating methodology to identify the appropriate payouts.\u003c/p\u003e\n\n\u003cp\u003eThe first valid submission to alert Arlo of a previously unknown issue qualifies for reward. Arlo builds products using a common platform and framework. Multiple products sometimes inherit the same vulnerability. When determining bounty awards, Arlo grants a single award that accounts for all affected products.\u003c/p\u003e\n\n\u003cp\u003eAll issues around login and access are of particular concern. Most login submissions classified as P5s will likely be elevated to P4 or greater issues.\u003c/p\u003e\n\n\u003ch3\u003eHigh Impact Rewards\u003c/h3\u003e\n\n\u003cp\u003eArlo rewards submissions that Arlo determines meets a below High Impact outcome. \u003cstrong\u003eArlo includes all products and services in scope for these rewards.\u003c/strong\u003e Cash Rewards will be awarded based on the following:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e$10,000\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eUnauthorized Access to all Arlo cloud storage video files.\u003c/li\u003e\n\u003cli\u003eUnauthorized Access to all Arlo live video feeds.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e$3,000\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eRemote Unauthorized access to only a single Arlo account’s live video feed (via the publicly accessible internet - i.e. not on the same LAN).\u003c/li\u003e\n\u003cli\u003eRemote Unauthorized access to only a single Arlo account’s cloud storage video files (via the publicly accessible internet - i.e. not on the same LAN).\u003c/li\u003e\n\u003cli\u003eRemote Unauthorized access to full Arlo database of customer information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eProgram Exclusions\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eProducts that reached End-Of-Life stage\u003c/li\u003e\n\u003cli\u003eDuplicate reports of security issues, including security issues identified internally.\u003c/li\u003e\n\u003cli\u003eCertain low to medium severity issues only affecting non-production environments (e.g. dev or staging environments) will be analyzed on a case-by-case basis and may be excluded.\u003c/li\u003e\n\u003cli\u003eAutomated scanning attacks.\u003c/li\u003e\n\u003cli\u003eSocial engineering (e.g. phishing, vishing).\u003c/li\u003e\n\u003cli\u003ePhysical attacks such as office access (e.g., open doors, tailgating).\u003c/li\u003e\n\u003cli\u003eDistributed Denial of Service attacks and Denial of Service attacks.\u003c/li\u003e\n\u003cli\u003eUI bugs, UX bugs, and spelling mistakes.\u003c/li\u003e\n\u003cli\u003eViolations of licenses or other restrictions applicable to any vendor's product.\u003c/li\u003e\n\u003cli\u003eVulnerabilities that are a result of malware.\u003c/li\u003e\n\u003cli\u003eTheoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, may be excluded.\u003c/li\u003e\n\u003cli\u003eIssues determined to be low impact such as reflected XSS without demonstrable impact may be excluded. Self-exploitation, such as self-XSS or self-DoS (unless it can be used to attack a different account) are excluded.\u003c/li\u003e\n\u003cli\u003eDiscovery of any in-use service whose version contains known vulnerabilities (such as a specific version of OpenSSL, Apache, Tomcat, etc.) without a demonstration of intrusion, information retrieval, or service disruption using that vulnerability.\u003c/li\u003e\n\u003cli\u003eIssues related to email misconfiguration (DMARC, etc.).\u003c/li\u003e\n\u003cli\u003eIssues related to rate limiting, unless they affect high risk areas (authentication, authorization, etc.). Submissions will be analyzed on a case-by-case basis and may be excluded.\u003c/li\u003e\n\u003cli\u003eAny session management vulnerabilities related to www.arlo.com.\u003c/li\u003e\n\u003cli\u003eAny leaked credentials for community.arlo.com, my.arlo.com and www.arlo.com.\u003c/li\u003e\n\u003cli\u003eAny issues related to investor.arlo.com\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eLegal Terms and Conditions\u003c/h3\u003e\n\n\u003cp\u003eIn addition to these Terms and Conditions regarding the Arlo Responsible Disclosure Program (the \"Program\"), there may be additional restrictions depending upon applicable local laws.\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003eThe parties to this Agreement are you and Arlo Technologies, Inc.\u003c/li\u003e\n\u003cli\u003e\"Arlo\" refers to Arlo Technologies, Inc. and its affiliates.\u003c/li\u003e\n\u003cli\u003eBy submitting the security bug, you affirm that you have not disclosed and agree that you will not disclose the security bug to anyone other than Arlo. Absent Arlo's prior written consent, any disclosure outside of this process would violate this Agreement. You agree that money damages may not be a sufficient remedy for a breach of this paragraph by you and that Arlo will be entitled to specific performance as a remedy for any such breach. Such remedy will not be deemed to be the exclusive remedy for any such breach but will be in addition to all other remedies available at law or equity to Arlo.\u003c/li\u003e\n\u003cli\u003eBy submitting information about a potential security bug, you are granting Arlo a worldwide, royalty-free, non-exclusive license to use your submission for the purpose of addressing security bugs in Arlo’s products and services.\u003c/li\u003e\n\u003cli\u003eIn the event of substantially duplicate submissions, Arlo may at its discretion provide a Reward only for the earliest received submission. Eligibility for Rewards, determination of the recipients, and amount of Reward is at the discretion of Arlo.\u003c/li\u003e\n\u003cli\u003eIf issues reported to our bug bounty program affect a third party or another vendor, Arlo reserves the right to forward details of the issue along to the party without further discussion with the researcher.\u003c/li\u003e\n\u003cli\u003eYou are responsible for all taxes associated with and imposed on any Reward you may receive from Arlo.\u003c/li\u003e\n\u003cli\u003eYou may only exploit, investigate, or target security bugs against your own accounts and/or your own devices. Testing must not violate any law, or disrupt or compromise any data or access data that is not yours; intentional access of customer data other than your own is prohibited.\u003c/li\u003e\n\u003cli\u003eIf you inadvertently access proprietary customer, employee, or business related information during your testing, the information must not be used, disclosed, stored, or recorded in any way. Inadvertent access of the data must be declared within your submission.\u003c/li\u003e\n\u003cli\u003eYour testing activities must not negatively impact Arlo, Arlo’s products or services generally, or Arlo's online environment availability or performance.\u003c/li\u003e\n\u003cli\u003eArlo may choose not to remediate at its sole discretion.\u003c/li\u003e\n\u003cli\u003eThis Agreement constitutes the entire agreement of the parties with respect to the items listed above. This Agreement is covered by California law. This Agreement may be amended or modified only by a subsequent agreement in writing.\u003c/li\u003e\n\u003cli\u003eIf any portion of this Agreement is found to be illegal or unenforceable, then the parties will be relieved of their responsibilities arising under such a portion, but only to the extent that such portion is illegal or unenforceable.\u003c/li\u003e\n\u003cli\u003eYou must not be the author of the code with the vulnerability.\u003c/li\u003e\n\u003cli\u003eYou must not be an Arlo employee, contractor, or a family member of an employee or contractor.\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003e\u003cem\u003eARLO RESERVES THE RIGHT TO MODIFY OR CANCEL THE ARLO RESPONSIBLE DISCLOSURE PROGRAM AT ANY TIME WITHOUT NOTICE. ALL PARTICIPANTS AND SUBMISSIONS ARE STRICTLY VOLUNTARY. THIS OFFER IS VOID WHERE PROHIBITED BY LAW AND IN PARTICIPATING, YOU MUST NOT VIOLATE ANY LAW. YOU ALSO MUST NOT DISRUPT ANY SERVICE OR COMPROMISE ANYONE’S DATA.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch3\u003eRules\u003c/h3\u003e\n\n\u003cp\u003eThis bounty follows Bugcrowd’s \u003ca href=\"https://researcherdocs.bugcrowd.com/docs/disclosure\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ePublic Disclosure Policy\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eRequests to disclose the results of a submission will be considered on a case by case basis and require explicit prior written consent from Arlo. \u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"720cf3a9-ef3c-4102-804d-778592557dee","name":"Arlo Devices","targets":[{"id":"a73630ed-a968-4ef3-bd9d-87b1bbcbd038","uri":"","name":"Arlo Safe Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"05c56e95-7466-4e1a-aeb8-7275073f8ca1","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"a73630ed-a968-4ef3-bd9d-87b1bbcbd038"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"a73630ed-a968-4ef3-bd9d-87b1bbcbd038"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"a73630ed-a968-4ef3-bd9d-87b1bbcbd038"}],"recentChangeFlags":null},{"id":"6c6e53df-14ca-46b0-a86b-e5597d5386f3","uri":"","name":"Arlo Safe iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d5804e45-485d-478d-a6e3-0d94c49899fb","sortOrder":1},"sortOrder":1,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"6c6e53df-14ca-46b0-a86b-e5597d5386f3"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"6c6e53df-14ca-46b0-a86b-e5597d5386f3"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"6c6e53df-14ca-46b0-a86b-e5597d5386f3"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"6c6e53df-14ca-46b0-a86b-e5597d5386f3"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"6c6e53df-14ca-46b0-a86b-e5597d5386f3"}],"recentChangeFlags":null},{"id":"09edc72f-7532-4cb0-a87e-5aa91788b03b","uri":null,"name":"Arlo Secure Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3bb17d5c-80a7-4908-af83-135412d4497a","sortOrder":2},"sortOrder":2,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"09edc72f-7532-4cb0-a87e-5aa91788b03b"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"09edc72f-7532-4cb0-a87e-5aa91788b03b"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"09edc72f-7532-4cb0-a87e-5aa91788b03b"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"09edc72f-7532-4cb0-a87e-5aa91788b03b"}],"recentChangeFlags":null},{"id":"e691ad25-ceb1-4051-8790-df98273a7044","uri":null,"name":"Arlo Secure iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"346217d3-c0d4-4a93-9a8f-c90b79c3d247","sortOrder":3},"sortOrder":3,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"e691ad25-ceb1-4051-8790-df98273a7044"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"e691ad25-ceb1-4051-8790-df98273a7044"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"e691ad25-ceb1-4051-8790-df98273a7044"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"e691ad25-ceb1-4051-8790-df98273a7044"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"e691ad25-ceb1-4051-8790-df98273a7044"}],"recentChangeFlags":null},{"id":"a94cfd57-eddb-45a6-b999-15f6c2b490da","uri":"","name":"Arlo All-In-One Sensor (Home Security System)","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8a8842c2-f9f3-47c4-9eac-eaf40d256005","sortOrder":4},"sortOrder":4,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"a94cfd57-eddb-45a6-b999-15f6c2b490da"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"a94cfd57-eddb-45a6-b999-15f6c2b490da"}],"recentChangeFlags":null},{"id":"2b88f772-2293-4bf8-88a8-340ece3a3227","uri":null,"name":"Arlo Base Station","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1efa0275-cf3c-416c-94c4-acfb3438194e","sortOrder":5},"sortOrder":5,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"2b88f772-2293-4bf8-88a8-340ece3a3227"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"2b88f772-2293-4bf8-88a8-340ece3a3227"}],"recentChangeFlags":null},{"id":"db138a2e-79ea-48f0-a112-7df0d005d92a","uri":"","name":"Arlo Cellular \u0026 Battery Backup (Home Security System)","category":"iot","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"640e7d39-dffe-4c4f-8253-4eefa21d145c","sortOrder":6},"sortOrder":6,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"db138a2e-79ea-48f0-a112-7df0d005d92a"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"db138a2e-79ea-48f0-a112-7df0d005d92a"}],"recentChangeFlags":null},{"id":"ab2db568-c16f-4406-a053-dbd86fdddbc7","uri":"","name":"Arlo Chime 2","category":"iot","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"dd70874f-feae-405e-bfe8-3e7fcda23a76","sortOrder":7},"sortOrder":7,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"ab2db568-c16f-4406-a053-dbd86fdddbc7"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"ab2db568-c16f-4406-a053-dbd86fdddbc7"}],"recentChangeFlags":null},{"id":"d8c37892-5778-4aac-a238-7edfad1eb66d","uri":"","name":"Arlo Essential 2 \u0026 3 (indoor \u0026 outdoor camera, doorbell)","category":"iot","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"080140c3-a6a4-4b41-8c5d-74cf9585a312","sortOrder":8},"sortOrder":8,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"d8c37892-5778-4aac-a238-7edfad1eb66d"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"d8c37892-5778-4aac-a238-7edfad1eb66d"}],"recentChangeFlags":null},{"id":"85da6a2c-08fd-462a-818d-63cae84af604","uri":null,"name":"Arlo Wired Floodlight","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fceb4d98-a1de-4387-9a83-f1359cfcc9f6","sortOrder":9},"sortOrder":9,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"85da6a2c-08fd-462a-818d-63cae84af604"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"85da6a2c-08fd-462a-818d-63cae84af604"}],"recentChangeFlags":null},{"id":"ba9b56ca-3b53-4aff-82dc-2762b0bee718","uri":null,"name":"Arlo Go v2","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ffcb8d51-64ba-47c7-8f93-bd8e9b971c33","sortOrder":10},"sortOrder":10,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"ba9b56ca-3b53-4aff-82dc-2762b0bee718"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"ba9b56ca-3b53-4aff-82dc-2762b0bee718"}],"recentChangeFlags":null},{"id":"3f97a855-4c9d-4d33-abc4-1e9f01fc2f7a","uri":"","name":"Arlo Home Security System","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ffb82b10-3d63-49d4-a7db-01b93804fce3","sortOrder":11},"sortOrder":11,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"3f97a855-4c9d-4d33-abc4-1e9f01fc2f7a"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"3f97a855-4c9d-4d33-abc4-1e9f01fc2f7a"}],"recentChangeFlags":null},{"id":"35c3d239-b00b-4dc0-8fd2-c0d88db7d5d8","uri":null,"name":"Arlo Pro 3 Floodlight","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f4c3b511-0c4a-4e61-a6ff-7591c65510af","sortOrder":12},"sortOrder":12,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"35c3d239-b00b-4dc0-8fd2-c0d88db7d5d8"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"35c3d239-b00b-4dc0-8fd2-c0d88db7d5d8"}],"recentChangeFlags":null},{"id":"4b5ac389-e95a-4599-adac-4555e52091ec","uri":null,"name":"Arlo Pro SmartHub","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"022c3f72-a0fe-4c3e-b8bf-bd7eb10d5e5e","sortOrder":13},"sortOrder":13,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"4b5ac389-e95a-4599-adac-4555e52091ec"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"4b5ac389-e95a-4599-adac-4555e52091ec"}],"recentChangeFlags":null},{"id":"f6d00196-3821-49ae-a847-ee5cc3a8453d","uri":"","name":"Arlo Pro 5S","category":"iot","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"be9b2dd9-692b-4021-8f01-3a93bba0214b","sortOrder":14},"sortOrder":14,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"f6d00196-3821-49ae-a847-ee5cc3a8453d"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"f6d00196-3821-49ae-a847-ee5cc3a8453d"}],"recentChangeFlags":null},{"id":"fce335d3-6b99-4c8b-ab17-d38a8fb56fad","uri":"","name":"Arlo Pro 6","category":"iot","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6a1e0bd0-5728-4471-9ace-0393feeb361c","sortOrder":15},"sortOrder":15,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"fce335d3-6b99-4c8b-ab17-d38a8fb56fad"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"fce335d3-6b99-4c8b-ab17-d38a8fb56fad"}],"recentChangeFlags":null},{"id":"d263108c-3f63-4d19-ae0a-8d997d80c763","uri":"","name":"Arlo Safe Button","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7a291dbe-56d6-4da9-b4b0-1df30c7f2f40","sortOrder":16},"sortOrder":16,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"d263108c-3f63-4d19-ae0a-8d997d80c763"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"d263108c-3f63-4d19-ae0a-8d997d80c763"}],"recentChangeFlags":null},{"id":"ee0dea96-32f6-4218-bf00-82755ff2e83b","uri":null,"name":"Arlo Ultra 2","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"702fdb21-3fa8-4cdc-91e8-4cbe786a73e5","sortOrder":17},"sortOrder":17,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"ee0dea96-32f6-4218-bf00-82755ff2e83b"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"ee0dea96-32f6-4218-bf00-82755ff2e83b"}],"recentChangeFlags":null},{"id":"be90866b-f3c1-4f85-b48d-e32c3903ee6f","uri":"","name":"Arlo Wireless Video Doorbell","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d8842ab2-d8d4-4514-a7a4-913d955ad52f","sortOrder":18},"sortOrder":18,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"be90866b-f3c1-4f85-b48d-e32c3903ee6f"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"be90866b-f3c1-4f85-b48d-e32c3903ee6f"}],"recentChangeFlags":null},{"id":"d9acadbb-3907-4e4e-b426-c7691bd63cd3","uri":"","name":"Arlo Wire-Free Outdoor Siren (Home Security System)","category":"iot","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"69b88a42-617f-4a5f-9986-8ff06b3ce53d","sortOrder":19},"sortOrder":19,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"d9acadbb-3907-4e4e-b426-c7691bd63cd3"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"d9acadbb-3907-4e4e-b426-c7691bd63cd3"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"6cf2d317-18e9-4e16-ab74-37c60d28dc8b","p1MaxCents":450000,"p1MinCents":300000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":60000,"p3MinCents":40000,"p4MaxCents":10000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":1000000},"descriptionHtml":"\u003ch3\u003eIf you have a device, you get access to more features to test.\u003c/h3\u003e\n\n\u003cp\u003e\u003cstrong\u003eThe majority of the Arlo platform and available attack surface is only made available to people who have access to an Arlo Device\u003c/strong\u003e (listed in the table below).Researchers are encouraged to purchase or otherwise get their hands on Arlo Devices as this is the best opportunity to find high-value, interesting bugs. Purchasing an Arlo Device will not only give Researchers Access to find bugs on the device itself, but will also provide access to the Arlo User Interface. Worth noting, Arlo has introduced new devices at competitive price points (in some cases under $40) which will help allow you to test more thoroughly.\u003c/p\u003e","rewardRangeData":{"1":{"min":3000,"max":4500},"2":{"min":1000,"max":1500},"3":{"min":400,"max":600},"4":{"min":100,"max":100},"5":{"min":null,"max":null},"programMax":10000},"recentChangeFlags":null},{"id":"74fcd0e9-530e-4f23-a257-1db5efd55eba","name":"All Other Production Arlo Targets","targets":[{"id":"e19dcc32-e396-472a-8e95-6bd74d1bdf23","uri":"","name":"*.arlo.com (subdomains impacting production customer-facing services)","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1b674001-1016-416c-b9d2-5aa04147eab3","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"97f795a6-6082-4399-8835-13dd499560e4","uri":"","name":"*.arloxcld.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9906923f-7d69-4e3a-a333-c566ab02c817","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"5e6d5fc2-44f4-44a0-b79c-2e85985d7776","uri":"","name":"https://*-prod.arlo.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4fb05cdc-1279-4429-9ca3-ddad146447a3","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"5e6d5fc2-44f4-44a0-b79c-2e85985d7776"}],"recentChangeFlags":null},{"id":"acb00c3a-7efa-4c52-b846-c2c05edf5dc5","uri":"","name":"https://beta.arlo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d3e6cbda-c139-44ae-ad1c-0c2850d7595a","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"acb00c3a-7efa-4c52-b846-c2c05edf5dc5"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"acb00c3a-7efa-4c52-b846-c2c05edf5dc5"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"acb00c3a-7efa-4c52-b846-c2c05edf5dc5"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"acb00c3a-7efa-4c52-b846-c2c05edf5dc5"}],"recentChangeFlags":null},{"id":"d2bbabff-83f0-4c2c-9bc1-293274a9e6e2","uri":"","name":"https://mcs.arlo.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"478621b5-320e-4970-bc99-ed9c4e2102ea","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d2bbabff-83f0-4c2c-9bc1-293274a9e6e2"}],"recentChangeFlags":null},{"id":"c84b7d8d-8444-451f-b89f-4c3508f6339c","uri":"https://my.arlo.com","name":"https://my.arlo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5a02e878-7ecc-42c0-be52-024de3423af5","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"c84b7d8d-8444-451f-b89f-4c3508f6339c"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c84b7d8d-8444-451f-b89f-4c3508f6339c"},{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"c84b7d8d-8444-451f-b89f-4c3508f6339c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c84b7d8d-8444-451f-b89f-4c3508f6339c"},{"id":"e4ad1c44-2f86-487b-9793-0add0dbfdcf2","name":"Zone.js","targetId":"c84b7d8d-8444-451f-b89f-4c3508f6339c"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"c84b7d8d-8444-451f-b89f-4c3508f6339c"}],"recentChangeFlags":null},{"id":"18bef4c1-e02b-42f3-a3e7-4dbf9345909f","uri":null,"name":"https://myapi.arlo.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f1d08419-d801-4836-a9e1-b340a16a1a4a","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"18bef4c1-e02b-42f3-a3e7-4dbf9345909f"}],"recentChangeFlags":null},{"id":"0f072827-d0cd-4aa2-934f-4fa2c1280778","uri":"https://www.arlo.com","name":"https://www.arlo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a7b864d3-4489-47f8-b7f8-8c2fe439ffd0","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"0f072827-d0cd-4aa2-934f-4fa2c1280778"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"0f072827-d0cd-4aa2-934f-4fa2c1280778"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"0f072827-d0cd-4aa2-934f-4fa2c1280778"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"0f072827-d0cd-4aa2-934f-4fa2c1280778"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"0f072827-d0cd-4aa2-934f-4fa2c1280778"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0f072827-d0cd-4aa2-934f-4fa2c1280778"}],"recentChangeFlags":null},{"id":"266bad20-daba-4e46-842e-aabf4550044d","uri":"","name":"https://updates.arlo.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f07bf13d-f37c-4eb3-809e-537d14b3873d","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"266bad20-daba-4e46-842e-aabf4550044d"}],"recentChangeFlags":null},{"id":"c98e58f6-757c-43a1-8e65-ed9c3ce70643","uri":"https://partnerapi.arlo.com","name":"https://partnerapi.arlo.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e828e45f-da04-4663-ae10-5c4f4bed2502","sortOrder":9},"sortOrder":9,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c98e58f6-757c-43a1-8e65-ed9c3ce70643"}],"recentChangeFlags":null},{"id":"9ddf69ba-4880-43ba-91b3-13eb52a524b4","uri":"","name":"*.arlocloud.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9f5eb2a4-916e-4ca0-bd1a-cd7bfbe8f723","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"b65eb1fd-ece9-4b36-a307-71a7996dd8c6","p1MaxCents":150000,"p1MinCents":100000,"p2MaxCents":50000,"p2MinCents":50000,"p3MaxCents":25000,"p3MinCents":10000,"p4MaxCents":5000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003e2025-10-06 Update: The following sites are excluded from the target scope effective immediately: community.arlo.com, survey.arlo.com, research.arlo.com\u003c/p\u003e\n\n\u003cp\u003e2025-09-02 Update: The bounty for P3 priority submissions is now set in the range of $150–400. Please note that only high impact subdomain takeover submissions, as determined by the Security Team, are eligible for payout. Depending on severity and demonstrated impact, such submissions may qualify for the higher end of the P3 reward range ($400) or, in exceptional cases, may be reclassified as P2–P1 priority issues. Submissions related to the arlostreaming and cvrstreaming subdomains will no longer be accepted.\u003c/p\u003e\n\n\u003cp\u003e2024-01-31 Update: the bounty for P3 priority submissions now falls under the range $150-400. In particular, low impact subdomain takeover submissions will be awarded $150. We will still consider certain high impact subdomain takeover submissions for the higher end of P3 rewards ($400) or even P2-P1 priorities, on a case by case basis.\u003c/p\u003e\n\n\u003cp\u003e2024-09-03 Update: any reports on specific IPs (no Arlo domain/subdomain) must include a supporting video showing the browser accessing the IP, opening the TLS certificate details to confirm the certificate belongs to Arlo, and detailed steps showing successful exploitation. It is OK to include other supporting evidence such as a Shodan screenshot showing the IP / Arlo hostname(s) / Arlo certificate, but please note this is not enough on its own since the system\u0026#39;s certificate snapshot taken by Shodan will be from hours/days/months earlier and by the time your report is submitted the instance could have been owned by other entities (in fact, this happens often, hence this update).\u003c/p\u003e","rewardRangeData":{"1":{"min":1000,"max":1500},"2":{"min":500,"max":500},"3":{"min":100,"max":250},"4":{"min":50,"max":50},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"60cd1cf7-0d22-4831-ba4f-d22a91097460","name":"Non-production Environments (Dev/QA/CAT/Test/Staging)","targets":[{"id":"85acc738-92ef-4eac-bc49-4640be6d894f","uri":"","name":"https://*dev*.arlo.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"166c2c20-5f8e-450e-a2f7-ea7d00d0ccb1","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"9ef72788-c1ab-4213-af11-1169bffd4b1b","uri":"","name":"https://*qa*.arlo.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5d0b8139-6d86-4089-835c-324f1ab437b1","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"956c7b78-33a4-45da-a9b4-9c50ca4a34f0","p1MaxCents":75000,"p1MinCents":50000,"p2MaxCents":25000,"p2MinCents":25000,"p3MaxCents":5000,"p3MinCents":5000,"p4MaxCents":2500,"p4MinCents":2500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":100000},"descriptionHtml":"\u003cp\u003eNon-production environments \u003c/p\u003e","rewardRangeData":{"1":{"min":500,"max":750},"2":{"min":250,"max":250},"3":{"min":50,"max":50},"4":{"min":25,"max":25},"5":{"min":null,"max":null},"programMax":1000},"recentChangeFlags":null},{"id":"905172ce-fb0b-41d1-a4cd-d086f430d0eb","name":"Out of Scope Targets","targets":[{"id":"4d7ddcda-e9e7-4598-936e-f42ebdd9016f","uri":"https://*streaming*.arlo.com","name":"*streaming*.arlo.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"681096a3-1e91-4162-8e08-63dba5c1a4df","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"74034f53-1583-44b5-8380-57e67e1c6208","uri":"","name":"cvrstreaming*.arlo.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0e79eeb0-4853-4b6e-bf12-644a32ac6581","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"d9615760-d588-467c-b93e-e3f19bcf1a61","uri":"http://community.arlo.com/","name":"http://community.arlo.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5b6d8598-6b06-4959-8626-55526780305c","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d9615760-d588-467c-b93e-e3f19bcf1a61"}],"recentChangeFlags":null},{"id":"a8d7f942-fa17-4195-9bad-e476e7e82f47","uri":"https://investor.arlo.com","name":"https://investor.arlo.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d9cd4129-5b30-47f2-b205-5457b44a131d","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a8d7f942-fa17-4195-9bad-e476e7e82f47"}],"recentChangeFlags":null},{"id":"d087a456-2faa-4c3d-bffe-a0fe0b66b7f9","uri":"http://research.arlo.com/","name":"http://research.arlo.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c0f59ad4-d4ce-4eeb-a55f-fde6c8af0927","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d087a456-2faa-4c3d-bffe-a0fe0b66b7f9"}],"recentChangeFlags":null},{"id":"7432601b-8129-446d-8a0b-3d7c608d67e3","uri":"http://survey.arlo.com/","name":"http://survey.arlo.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c49ec831-ae8a-4f40-8daf-83b95f05eb6a","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7432601b-8129-446d-8a0b-3d7c608d67e3"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":3,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"fbf1be67-bc67-4ddd-82f2-484d63200b4b","code":"arlo","state":"in_progress","endsAt":null,"bountyId":"a3a078d6-c960-48ef-8e6e-14ed9116eebc","startsAt":"2018-05-16T19:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/9fbb/8c88/26d3223f/d37417924219f5a94c4832c96d118948_arlo.jpg","logoBackgroundColor":"#04ab51","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2018-05-16T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/arlo","changelogs":"/engagements/arlo/changelog","submissions":null,"announcements":"/engagements/arlo/announcements","hallOfFame":"/engagements/arlo/hall_of_fames","crowdstream":"/engagements/arlo/crowdstream"},"announcementsCount":15,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/arlo/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=arlo\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/arlo/engagement_subscribers","engagementChangelogsUrl":"/engagements/arlo/changelog","publishedAt":"2026-07-21T17:16:56.332Z","engagementChangelogUrl":"/engagements/arlo/changelog/715a1af5-50c4-4cfa-842a-048134e77d84","createUserFeedbacksUrl":"/engagements/arlo/feedbacks","engagementCrowdstreamUrl":"/engagements/arlo/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}