{"id":"d35822f8-27fd-45fb-a809-dd938162c247","engagementId":"7ddb30b4-6e9b-4ba6-8d96-d39907dfee3b","data":{"brief":{"id":"5fbabeca-10a2-4b06-8f7b-9039f4303cc6","name":"Bath \u0026 Body Works Vulnerability Disclosure Program","tagline":"Bath \u0026 body works, Inc. makes the world a brighter, happier place through the power of fragrance. Please submit your findings to this Vulnerability Disclosure Program.","description":"\u003cp\u003eBath \u0026amp; Body Works is a global leader in personal care and home fragrance, including the top-selling collections for fine fragrance mist, body lotion and body cream, 3-wick candles, home fragrance diffusers and liquid hand soap. Powered by agility and innovation, the company’s predominantly U.S.-based supply chain enables the company to deliver quality, on-trend luxuries at affordable prices.\u003c/p\u003e\n\n\u003cp\u003eNo technology is perfect, and Bath \u0026amp; Body Works believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our target. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Bath \u0026amp; Body Works not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before submitting.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess/Credentials\u003c/h2\u003e\n\n\u003cp\u003eTarget is accessible via public internet. Sign up using your @bugcrowdninja.com email only. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eClickjacking on non-sensitive pages\u003c/li\u003e\n\u003cli\u003eAttacks requiring MITM or physical access to a user's device\u003c/li\u003e\n\u003cli\u003eAny activity that could lead to the disruption of our service (DoS)\u003c/li\u003e\n\u003cli\u003eMissing best practices in Content Security Policy\u003c/li\u003e\n\u003cli\u003eResults from automated tools without any manual confirmation\u003c/li\u003e\n\u003cli\u003eLogin/Logout CSRF\u003c/li\u003e\n\u003cli\u003eLack of Secure/HTTPOnly flags on non-sensitive Cookies\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"0a04d7eb-421e-4a65-a540-7010a8f107e2","name":"In Scope Targets","targets":[{"id":"27bc8390-ae77-4802-b435-5830cbb9d750","uri":"https://bbwinc.com","name":"bbwinc.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2099e61e-9a31-47a8-8cbc-0c0ced072ff3","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"27bc8390-ae77-4802-b435-5830cbb9d750"}],"recentChangeFlags":null},{"id":"1dcd3d86-8dee-4977-a97f-b8bb1fc23b18","uri":"https://www.bathandbodyworks.com/","name":"Bath \u0026 Body Works US ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5f815fc2-a5a9-4f29-8d16-e06546f0f4b9","sortOrder":1},"sortOrder":1,"tags":[{"id":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","name":"Retail","targetId":"1dcd3d86-8dee-4977-a97f-b8bb1fc23b18"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1dcd3d86-8dee-4977-a97f-b8bb1fc23b18"}],"recentChangeFlags":null},{"id":"5418c61e-61e3-4f07-b97b-a0a61c3a5a13","uri":"https://www.bathandbodyworks.ca/","name":"Bath \u0026 Body Works Canada","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bf67d0b3-d5af-438a-b959-275b6fe675f8","sortOrder":2},"sortOrder":2,"tags":[{"id":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","name":"Retail","targetId":"5418c61e-61e3-4f07-b97b-a0a61c3a5a13"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5418c61e-61e3-4f07-b97b-a0a61c3a5a13"}],"recentChangeFlags":null},{"id":"bda120c5-22a2-4b6f-9ff2-eecd14d35206","uri":"https://apps.apple.com/us/app/bath-body-works-b-bw/id1256027729","name":"BBW US iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5467335d-08b9-4967-a131-ca61baf5552d","sortOrder":3},"sortOrder":3,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"bda120c5-22a2-4b6f-9ff2-eecd14d35206"}],"recentChangeFlags":null},{"id":"03de7139-2e3e-4d73-bb4f-28eba7114e70","uri":"https://play.google.com/store/apps/details?id=com.bathandbody.bbw\u0026hl=en_US","name":"BBW US Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a44f5ae9-c82d-491f-ba7f-51eb40fb6552","sortOrder":4},"sortOrder":4,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"03de7139-2e3e-4d73-bb4f-28eba7114e70"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"7ddb30b4-6e9b-4ba6-8d96-d39907dfee3b","code":"bbw-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"8d6cbf23-1366-41f4-a331-d75dc121d5a2","startsAt":"2023-04-01T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/af30/35b4/61146e69/3580dace3b077a90d274c05f319e73c2_1519855924437.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2023-04-01T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/bbw-vdp-pro","changelogs":"/engagements/bbw-vdp-pro/changelog","submissions":null,"announcements":"/engagements/bbw-vdp-pro/announcements","hallOfFame":"/engagements/bbw-vdp-pro/hall_of_fames","crowdstream":"/engagements/bbw-vdp-pro/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/bbw-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=bbw-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/bbw-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/bbw-vdp-pro/changelog","publishedAt":"2026-07-13T20:36:08.256Z","engagementChangelogUrl":"/engagements/bbw-vdp-pro/changelog/d35822f8-27fd-45fb-a809-dd938162c247","createUserFeedbacksUrl":"/engagements/bbw-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/bbw-vdp-pro/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}