{"id":"52f1edb8-fb90-4c5a-aafc-686c4c783f4b","engagementId":"e1993885-ed60-4ff0-82be-809e945732c9","data":{"brief":{"id":"8837ad82-50ae-4f63-a17f-873490ba6475","name":"Arrow Electronics VDP","tagline":"We create, make and manage technology to make life not only different, but better.","description":"\u003cp\u003eNo technology is perfect and Arrow Electronics believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web apps. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003ePlease note: The use of automated scanning tools is prohibited.  If you are identified as using automated scanning tools, you will be asked to leave the Arrow VDP program.\u003c/h2\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"d7a636ff-c862-4101-a74f-f556036a5772","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Arrow Electronics not listed in the targets section is out of scope. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Arrow Electronics, you may report it to this program. \u003c/p\u003e\n\n\u003cp\u003ePlease be aware that this is a vulnerability disclosure program, which does not pay out rewards for findings. \u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003ePlease note: If you are identified as using automated scanning tools that cause a denial of service attack on our sites, you will be asked to leave the Arrow VDP program.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eSubmissions must be submitted in plain text formats. Supporting videos and images are fine as long as they are in standard, cross-platform formats. Submissions in other formats (e.g. DOCX, PDF, etc.,) will be asked to for re-submission in a plain text format.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eFor testing, please add the following HTTP header that includes your Bugcrowd username. This will help the Arrow Electronics team identify that activity is coming from a researcher on the program and ensure that your testing is not blocked or interrupted.\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eIdentifier\u003c/th\u003e\n\u003cth\u003eHeader\u003c/th\u003e\n\u003cth\u003eExample\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eUsername\u003c/td\u003e\n\u003ctd\u003eX-Bug-Bounty: Bugcrowd-\u0026lt;Username\u0026gt;\u003c/td\u003e\n\u003ctd\u003eX-Bug-Bounty: Bugcrowd-proresearcher\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eThe targets in scope for this program are:\u003c/p\u003e\n\n\u003cp\u003e*.arrow.com\u003cbr\u003e\n*.verical.com\u003cbr\u003e\n*.richardsonrfpd.com\u003cbr\u003e\n*.immixgroup.com\u003cbr\u003e\n*.powerandsignal.com\u003cbr\u003e\n*.einfochips.com\u003cbr\u003e\n*.siliconexpert.com\u003cbr\u003e\n*.aepetsche.com\u003cbr\u003e\n*.elektroda.pl\u003cbr\u003e\n*.xsp.arrow.com\u003cbr\u003e\n*.arrow.cn\u003cbr\u003e\n*.chip1stop.com\u003cbr\u003e\n*.transim.com\u003cbr\u003e\n*.aspencore.com\u003cbr\u003e\n*.eetimes.com\u003cbr\u003e\n*.Niccomp.com\u003cbr\u003e\n*.senecadata.com\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll targets are publicly accessible.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll credentials can be obtained via self-signup.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eOut of Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny access, destruction, alteration, public disclosure of, or otherwise negatively impacting attack against Arrow systems and/or data.\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eAny domain, property, product, protocol, or service of the domains not explicitly listed in the In-Scope section is out of scope.\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eAny attack causing a denial of service (DoS), or distributed denial of service (DDoS) conditions.\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eAny attacks against Arrow staff are explicitly out-of-scope for this program.\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eAutomated scanning tools are out of scope for this program. \u003c/li\u003e\n\u003cli\u003eAccessing, downloading, or modifying data residing in customer accounts. \u003c/li\u003e\n\u003cli\u003eTesting Arrow affiliates or third-party applications or services. \u003c/li\u003e\n\u003cli\u003e*.com/autodiscover related issues. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eExcluded Finding Types\u003c/h3\u003e\n\n\u003cp\u003eThe following finding types are specifically excluded:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eEmail Spoofing to Inbox due to Missing or Misconfigured DMARC on Email Domain, any *.autodiscover related issues. \u003c/li\u003e\n\u003cli\u003eMissing HTTP security headers, specifically:\u003c/li\u003e\n\u003cli\u003eHTTP Strict Transport Security (HSTS)\u003c/li\u003e\n\u003cli\u003ePublic Key Pinning Extension for HTTP (HPKP)\u003c/li\u003e\n\u003cli\u003eX-Frame-Options\u003c/li\u003e\n\u003cli\u003eX-XSS-Protection\u003c/li\u003e\n\u003cli\u003eX-Content-Type-Options\u003c/li\u003e\n\u003cli\u003eContent-Security-Policy\u003c/li\u003e\n\u003cli\u003eX-Permitted-Cross-Domain-Policies\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eReferrer-Policy\u003c/li\u003e\n\u003cli\u003eHTTP Methods - OPTIONS, PUT, TRACE, CONNECT, PATCH\u003c/li\u003e\n\u003cli\u003eHTTP or DNS cache poisoning\u003c/li\u003e\n\u003cli\u003eNo load testing (DoS/DDoS) on the application(s) or network\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"9764d464-33fc-493b-8d55-09a40083b144","name":"Arrow Electronics Target Group","targets":[{"id":"211a7637-48ea-4731-aef7-3e289332810c","uri":"https://xsp.arrow.com/","name":"*.xsp.arrow.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fac1db4a-5adf-4787-ae85-ae670e9f4bee","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"211a7637-48ea-4731-aef7-3e289332810c"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"211a7637-48ea-4731-aef7-3e289332810c"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"211a7637-48ea-4731-aef7-3e289332810c"},{"id":"a5a8125d-2e24-4979-a994-d67089f0909b","name":"Apache Tomcat","targetId":"211a7637-48ea-4731-aef7-3e289332810c"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"211a7637-48ea-4731-aef7-3e289332810c"}],"recentChangeFlags":null},{"id":"50f94622-7c62-409c-8e62-d3c807a23ba1","uri":"https://*.arrow.cn","name":"*.arrow.cn","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5e8c98ee-7ca8-4b06-af6e-4d15bcd1126f","sortOrder":0},"sortOrder":0,"tags":[{"id":"1bf3970a-395b-4456-b261-d04dab482af2","name":"eCommerce","targetId":"50f94622-7c62-409c-8e62-d3c807a23ba1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"50f94622-7c62-409c-8e62-d3c807a23ba1"}],"recentChangeFlags":null},{"id":"8332b32f-22fa-47f1-840f-863c1759052e","uri":"https://*.aspencore.com","name":"*.aspencore.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"03635d4f-03af-45f0-9df6-ea46f52edb75","sortOrder":0},"sortOrder":0,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"8332b32f-22fa-47f1-840f-863c1759052e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8332b32f-22fa-47f1-840f-863c1759052e"}],"recentChangeFlags":null},{"id":"34de1f1c-a7bb-4f8d-97de-fe202226ee34","uri":"https://www.transim.com/","name":"*.transim.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bf866c58-befc-41b0-86d4-8bd257a07ce5","sortOrder":0},"sortOrder":0,"tags":[{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"34de1f1c-a7bb-4f8d-97de-fe202226ee34"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"34de1f1c-a7bb-4f8d-97de-fe202226ee34"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"34de1f1c-a7bb-4f8d-97de-fe202226ee34"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"34de1f1c-a7bb-4f8d-97de-fe202226ee34"}],"recentChangeFlags":null},{"id":"7cc3666e-f834-4737-a4ff-28c860684776","uri":"https://www.richardsonrfpd.com/","name":"*.richardsonrfpd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8f3636a8-1bd4-43a5-b7cf-4595f7d38dd6","sortOrder":0},"sortOrder":0,"tags":[{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"7cc3666e-f834-4737-a4ff-28c860684776"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"7cc3666e-f834-4737-a4ff-28c860684776"},{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"7cc3666e-f834-4737-a4ff-28c860684776"},{"id":"7f59a79f-f8d7-4163-bf91-97dc53c7cc1a","name":"SSL/TLS","targetId":"7cc3666e-f834-4737-a4ff-28c860684776"},{"id":"962bcd4a-8c22-4579-8cae-e9d2d1a8564a","name":"Azure DevOps Server","targetId":"7cc3666e-f834-4737-a4ff-28c860684776"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"7cc3666e-f834-4737-a4ff-28c860684776"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7cc3666e-f834-4737-a4ff-28c860684776"}],"recentChangeFlags":null},{"id":"1b247632-ad3e-47e8-94ca-87b14729fccf","uri":"https://einfochips.com/","name":"*.einfochips.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ba562452-85ec-4dcf-8071-7d638ec7de03","sortOrder":0},"sortOrder":0,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"1b247632-ad3e-47e8-94ca-87b14729fccf"},{"id":"a5a8125d-2e24-4979-a994-d67089f0909b","name":"Apache Tomcat","targetId":"1b247632-ad3e-47e8-94ca-87b14729fccf"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"1b247632-ad3e-47e8-94ca-87b14729fccf"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1b247632-ad3e-47e8-94ca-87b14729fccf"}],"recentChangeFlags":null},{"id":"08170ecf-d7de-4228-b115-88e98b209717","uri":"https://siliconexpert.com/","name":"*.siliconexpert.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6ad88ed9-ca81-48fb-8b33-9a7026d4735d","sortOrder":0},"sortOrder":0,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"08170ecf-d7de-4228-b115-88e98b209717"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"08170ecf-d7de-4228-b115-88e98b209717"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"08170ecf-d7de-4228-b115-88e98b209717"}],"recentChangeFlags":null},{"id":"a427281d-bd43-4d7b-8eff-ee5252df0b79","uri":"http://aepetsche.com/","name":"*.aepetsche.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6346a9d9-0413-422c-8edb-204211835041","sortOrder":0},"sortOrder":0,"tags":[{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"a427281d-bd43-4d7b-8eff-ee5252df0b79"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"a427281d-bd43-4d7b-8eff-ee5252df0b79"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a427281d-bd43-4d7b-8eff-ee5252df0b79"}],"recentChangeFlags":null},{"id":"939730fa-dae4-416f-9d98-3e094f651eed","uri":"https://elektroda.pl/","name":"*.elektroda.pl","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"448d7c60-5484-471b-b547-fc73f21285bd","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"939730fa-dae4-416f-9d98-3e094f651eed"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"939730fa-dae4-416f-9d98-3e094f651eed"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"939730fa-dae4-416f-9d98-3e094f651eed"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"939730fa-dae4-416f-9d98-3e094f651eed"}],"recentChangeFlags":null},{"id":"7ae98660-e519-48de-a275-7aabb306e809","uri":"https://eetimes.com/","name":"*.eetimes.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0f493c45-8991-4f71-af36-e9357baee430","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"7ae98660-e519-48de-a275-7aabb306e809"},{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"7ae98660-e519-48de-a275-7aabb306e809"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"7ae98660-e519-48de-a275-7aabb306e809"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7ae98660-e519-48de-a275-7aabb306e809"}],"recentChangeFlags":null},{"id":"ad17feb0-6c96-4c18-bd86-44326aac993b","uri":"https://verical.com/","name":"*.verical.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"250cc79c-a696-42d4-abef-ea25b2d3731e","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"ad17feb0-6c96-4c18-bd86-44326aac993b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ad17feb0-6c96-4c18-bd86-44326aac993b"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"ad17feb0-6c96-4c18-bd86-44326aac993b"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"ad17feb0-6c96-4c18-bd86-44326aac993b"}],"recentChangeFlags":null},{"id":"2c2b08b1-1c18-4823-b5cb-83135c170c33","uri":"https://powerandsignal.com/","name":"*.powerandsignal.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ab6d9645-74bc-4124-936f-019873389a6b","sortOrder":0},"sortOrder":0,"tags":[{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"2c2b08b1-1c18-4823-b5cb-83135c170c33"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"2c2b08b1-1c18-4823-b5cb-83135c170c33"},{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"2c2b08b1-1c18-4823-b5cb-83135c170c33"},{"id":"7f59a79f-f8d7-4163-bf91-97dc53c7cc1a","name":"SSL/TLS","targetId":"2c2b08b1-1c18-4823-b5cb-83135c170c33"},{"id":"962bcd4a-8c22-4579-8cae-e9d2d1a8564a","name":"Azure DevOps Server","targetId":"2c2b08b1-1c18-4823-b5cb-83135c170c33"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"2c2b08b1-1c18-4823-b5cb-83135c170c33"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"2c2b08b1-1c18-4823-b5cb-83135c170c33"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2c2b08b1-1c18-4823-b5cb-83135c170c33"}],"recentChangeFlags":null},{"id":"3eff88f4-494c-4ab6-a67d-1c54cf53daba","uri":"https://arrow.com/","name":"*.arrow.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e4708e53-f365-4b71-9d7d-6bca3fbb8dfd","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"3eff88f4-494c-4ab6-a67d-1c54cf53daba"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"3eff88f4-494c-4ab6-a67d-1c54cf53daba"},{"id":"7f59a79f-f8d7-4163-bf91-97dc53c7cc1a","name":"SSL/TLS","targetId":"3eff88f4-494c-4ab6-a67d-1c54cf53daba"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3eff88f4-494c-4ab6-a67d-1c54cf53daba"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"3eff88f4-494c-4ab6-a67d-1c54cf53daba"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"3eff88f4-494c-4ab6-a67d-1c54cf53daba"}],"recentChangeFlags":null},{"id":"cb7a682f-fd20-4379-bfe2-219c412bdb24","uri":"https://immixgroup.com/","name":"*.immixgroup.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"91e53f05-7e35-4158-a8d2-472cf14abc10","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"cb7a682f-fd20-4379-bfe2-219c412bdb24"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"cb7a682f-fd20-4379-bfe2-219c412bdb24"},{"id":"7f59a79f-f8d7-4163-bf91-97dc53c7cc1a","name":"SSL/TLS","targetId":"cb7a682f-fd20-4379-bfe2-219c412bdb24"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"cb7a682f-fd20-4379-bfe2-219c412bdb24"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cb7a682f-fd20-4379-bfe2-219c412bdb24"}],"recentChangeFlags":null},{"id":"ec66a6fa-2911-4e5a-ab70-bfe24a93c6bd","uri":"https://niccomp.com","name":"*.niccomp.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"70139550-9075-4abd-9bc2-7f884ddf0a48","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"ec66a6fa-2911-4e5a-ab70-bfe24a93c6bd"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"ec66a6fa-2911-4e5a-ab70-bfe24a93c6bd"}],"recentChangeFlags":null},{"id":"049f7abd-860b-4172-9e2b-6f59bbdf7f42","uri":"https://senecadata.com","name":"*.senecadata.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"67f25630-11c6-4fbe-afc2-5c192ff2965d","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"e1993885-ed60-4ff0-82be-809e945732c9","code":"arrow-electronics-vdp","state":"in_progress","endsAt":null,"bountyId":"595fe36c-c7bc-41c1-b136-cdfdc3a68b01","startsAt":"2020-12-01T19:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Electronics","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/bd8f/2e21/01c0cdd0/07159d2e89527f5f69b91b7be3529d76_ArrowElectronics_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-12-01T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/arrow-electronics-vdp","changelogs":"/engagements/arrow-electronics-vdp/changelog","submissions":null,"announcements":"/engagements/arrow-electronics-vdp/announcements","hallOfFame":"/engagements/arrow-electronics-vdp/hall_of_fames","crowdstream":"/engagements/arrow-electronics-vdp/crowdstream"},"announcementsCount":3,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/arrow-electronics-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=arrow-electronics-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/arrow-electronics-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/arrow-electronics-vdp/changelog","publishedAt":"2026-04-02T14:25:44.250Z","engagementChangelogUrl":"/engagements/arrow-electronics-vdp/changelog/52f1edb8-fb90-4c5a-aafc-686c4c783f4b","createUserFeedbacksUrl":"/engagements/arrow-electronics-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/arrow-electronics-vdp/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}