{"id":"64d8b852-10c6-48e4-bdf0-07e739366d30","engagementId":"e82fee68-af95-4dbd-8b05-0d7d2abcc673","data":{"brief":{"id":"ccc236fc-af79-48f8-ad6b-65e1753a60ee","name":"Belong Vulnerability Disclosure Engagement","tagline":"We help more Aussies feel like they belong, by providing the tools to participate in the digital world. ","description":"\u003cp\u003e\u003cstrong\u003eAbout Belong:\u003c/strong\u003e\u003cbr\u003e\nWelcome to the Belong Vulnerability Disclosure Program (VDP).  Telstra started Belong in 2013. The plan was to start a company that could offer the usual telco things at a lower price. That meant no stores or new phone deals, but the same great security and coverage – using parts of the Telstra mobile network.\u003c/p\u003e\n\n\u003cp\u003eAt Belong, the security of our systems and customer data is a top priority. We recognize that no technology is flawless, and we highly value the expertise of security researchers worldwide in helping us identify and mitigate potential vulnerabilities. Your contributions play a vital role in strengthening our security posture.\u003c/p\u003e\n\n\u003cp\u003eAs the program evolves, we will continue to onboard new systems into scope. Stay tuned for updates and announcements on this page\u003c/p\u003e\n\n\u003cp\u003eThank you for participating in the Belong Vulnerability Disclosure Program (VDP). We look forward to working together to make our digital ecosystem more secure.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eEligibility\u003c/strong\u003e\u003cbr\u003e\nNote that the Belong VDP program is in part facilitated through a third party (Bugcrowd) that performs additional services, and eligibility checks on our behalf. For example, Belong may not issue rewards if one or more of the following is applicable:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou are a resident of a country under Australian or U.S. sanctions or live in a country that prohibits this type of program.\u003c/li\u003e\n\u003cli\u003eYou are currently (or were in the last 6 months) an employee of Telstra, a Telstra subsidiary, or a third-party contractor with access to Telstra or Belong’s internal systems and networks.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eRatings/Rewards:\u003c/strong\u003e\u003cbr\u003e\nFor the initial prioritisation/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eTesting Authorization:\u003c/strong\u003e\u003cbr\u003e\nTesting is only authorised on the targets listed as in scope. Any domain/property of Belong not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Belong, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003cp\u003eWe cannot authorise testing against these systems.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eAccess:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll targets are publicly facing and do not need additional steps to access them.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eFocus Areas:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAPIs\u003c/li\u003e\n\u003cli\u003eMobile apps\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eCredentials:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThis program is set up as an unauthenticated program. The use of personal credentials for testing purposes is strictly prohibited.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eExcluded Vulnerability Types\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eDenial of Service (DoS) or Distributed Denial of Service (DDoS) attacks are not permitted.\u003c/li\u003e\n\u003cli\u003eSocial Engineering and any interaction with Belong physical locations, employees and customers.\u003c/li\u003e\n\u003cli\u003eAny attacks which may impact the usability of customer facing services.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eOut of Scope:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease do not submit forms that may trigger contact with Belong staff, Examples include signing up for products or contacting Belong customer support.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003ePartial Safe Harbour:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com\u003c/em\u003e\u003c/strong\u003e\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":"\u003ch1\u003eSubmission Requirements\u003c/h1\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCategory\u003c/th\u003e\n\u003cth\u003eSpecification\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eCustom Request Header\u003c/td\u003e\n\u003ctd\u003eX-Bug-Bounty: BugCrowd-\u0026lt;username\u0026gt;\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eAutomated Tooling Rate Limit\u003c/td\u003e\n\u003ctd\u003eMaximum of 5 requests per second\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e"},"scope":[{"id":"42b8205a-6167-40db-ba8c-c62d0d9734ef","name":"In-Scope Targets","targets":[{"id":"72f56359-4569-451b-9882-c48c2a790d01","uri":"https://www.belong.com.au","name":"https://www.belong.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4eabe607-6a34-4487-91ce-1dbb3daa35a3","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"72f56359-4569-451b-9882-c48c2a790d01"}],"recentChangeFlags":null},{"id":"c936dfc4-068b-4b56-bd24-76739cfd2657","uri":"","name":"Belong iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"49295bda-4ec0-446e-936c-6fd502fc5e78","sortOrder":1},"sortOrder":1,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"c936dfc4-068b-4b56-bd24-76739cfd2657"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"c936dfc4-068b-4b56-bd24-76739cfd2657"}],"recentChangeFlags":null},{"id":"5c90a2a8-3faf-4bf9-b136-35d2b6f9b3f6","uri":"","name":"Belong Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7c6cd373-fcba-42ba-9877-e9dc2e2cb4b7","sortOrder":2},"sortOrder":2,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"5c90a2a8-3faf-4bf9-b136-35d2b6f9b3f6"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"5c90a2a8-3faf-4bf9-b136-35d2b6f9b3f6"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"c2278b12-d3f6-4d0c-9816-703c11b805d4","name":"Out of Scope Targets","targets":[{"id":"22fa0756-f288-4469-a295-70853bbe4e73","uri":"https://www.belong.blue","name":"https://www.belong.blue","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"866f87b5-709d-4dc4-91a6-fdab4dfa6463","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"22fa0756-f288-4469-a295-70853bbe4e73"}],"recentChangeFlags":null},{"id":"7e821585-972f-4bcc-aee8-9cb8637c307f","uri":"https://api.belong.blue","name":"api.belong.blue","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3b51d12f-eaec-421f-af14-c89136c69009","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"e82fee68-af95-4dbd-8b05-0d7d2abcc673","code":"belong-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"6c78a392-e4ee-4d9d-af49-aa539dd96409","startsAt":"2025-04-08T23:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/f2dd/14b9/b4d6c49f/d601caecf9775a2532e80fd90aac5f5a_BelongLogo20190521_Supplied_450x250.png","logoBackgroundColor":"#000","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-04-08T23:00:00.023Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/belong-vdp-pro","changelogs":"/engagements/belong-vdp-pro/changelog","submissions":null,"announcements":"/engagements/belong-vdp-pro/announcements","hallOfFame":"/engagements/belong-vdp-pro/hall_of_fames","crowdstream":null},"announcementsCount":1,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/belong-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=belong-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/belong-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/belong-vdp-pro/changelog","publishedAt":"2025-10-09T22:33:22.641Z","engagementChangelogUrl":"/engagements/belong-vdp-pro/changelog/64d8b852-10c6-48e4-bdf0-07e739366d30","createUserFeedbacksUrl":"/engagements/belong-vdp-pro/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}