{"id":"4ad9133f-71cb-49fe-af21-7281256de830","engagementId":"991f9a22-7b7f-46c6-80b2-877dd1a8078f","data":{"brief":{"id":"995c22d9-793f-4f48-9fb7-4e51937643d1","name":"Bendigo Bank Responsible Disclosure Program","tagline":"Bendigo Bank, Australia's most trusted bank, is recognized by 2.7 million and counting Aussies as a significant financial institution.","description":"\u003cp\u003eAs one of Australia's most trusted banks, we take protection of our information, systems, and\u003cbr\u003e\nnetworks very seriously. Our systems are built on a foundation of best-practice security standards,\u003cbr\u003e\nensuring a high level of protection, we are committed to securing and protecting our customer's\u003cbr\u003e\npersonal data and privacy.\u003c/p\u003e\n\n\u003cp\u003eBendigo Bank is implementing the vulnerability disclosure engagement powered by Bugcrowd,\u003cbr\u003e\nwith the aim to enhance security by enabling the reporting and prompt resolution of vulnerabilities\u003cbr\u003e\nin our systems. We are committed to addressing any potential weaknesses, minimising risks, and\u003cbr\u003e\nimproving our overall security posture. \u003c/p\u003e\n\n\u003ch2\u003eRatings / Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. \u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhile there are no monetary payments for findings on this program, your contribution to our security is highly valued.\u003c/strong\u003e \u003c/p\u003e","industryTagId":"b3d6ff0b-119e-4f5b-9c38-ee13f125fc52","targetsOverview":"\u003cp\u003e\u003cem\u003eIf you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Bendigo \u0026amp; Adelaide Bank, you can report it to this engagement.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eCredentials\u003c/h2\u003e\n\n\u003cp\u003eUnauthenticated testing is only permitted. Any form of testing using credentials, whether owned or obtained, is strictly prohibited. \u003c/p\u003e\n\n\u003ch2\u003eRules of Engagement\u003c/h2\u003e\n\n\u003cp\u003eTo safeguard the integrity of research and ensure responsible practices, all researchers must follow these guidelines during testing:  \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eProduction-Safe Testing: All testing must be conducted in a manner that does not disrupt services, impact availability, or affect the experience of other users. Testing is performed on production environments, so caution is critical.\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eRate Limiting: Automated scanning is limited to 6 requests per second (rps) to prevent excessive load on systems.\u003cbr\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eInteracting or manipulate other stakeholders and their associated accounts including:\n\n\u003cul\u003e\n\u003cli\u003eSocial engineering attacks\u003c/li\u003e\n\u003cli\u003ePhishing attacks\u003c/li\u003e\n\u003cli\u003ePhysical attacks\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eThird party providers and services\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePotential post-exploitation scenarios\u003c/strong\u003e: If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding. We will work with you to evaluate the vulnerability and award you accordingly for the final impact and severity. \u003c/li\u003e\n\u003cli\u003eAvailability/Volumetric testing e.g.:\n\n\u003cul\u003e\n\u003cli\u003eDoS/DDoS/Network DoS\u003c/li\u003e\n\u003cli\u003eRate limiting bypass attempts\u003c/li\u003e\n\u003cli\u003eEmail bombing flooding\u003c/li\u003e\n\u003cli\u003eExploits that cause permanent changes to systems (e.g., Stored Cross-Site Scripting).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eScanning\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eBendigo Bank will not accept generic vulnerability scan results without proof of concept or a clear path to exploitation. \u003c/li\u003e\n\u003cli\u003eScanning or brute-force attempts targeting submission forms should not be performed.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eP5 vulnerabilities\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eConfidentiality\u003c/h2\u003e\n\n\u003cp\u003eYou must treat all information as strictly confidential and not share or otherwise use it for any purpose other than for reporting. You are expected, as always, to comply at all times with all applicable laws and with the BugCrowd \u003ca href=\"https://www.bugcrowd.com/resources/hacker-resources/standard-disclosure-terms/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eStandard Disclosure Terms\u003c/a\u003e | Bugcrowd.  \u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":null,"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"39cef47d-13c5-4b9a-974e-53d9cc22992a","name":"Bendigo \u0026 Adelaide Bank","targets":[{"id":"a0c6adfc-2775-4813-840a-e9c7de4cd5b5","uri":"","name":"*.bendigobank.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"36101e1b-2ed0-4b52-bf3d-bd7476bfae99","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a0c6adfc-2775-4813-840a-e9c7de4cd5b5"}],"recentChangeFlags":null},{"id":"bc5b9e04-bb90-4e28-9eb2-9ab732772667","uri":"","name":"*.adelaidebank.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ba8859b9-1993-44b9-9576-8867177c7a06","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bc5b9e04-bb90-4e28-9eb2-9ab732772667"}],"recentChangeFlags":null},{"id":"09e0ebbe-b2d5-42ef-b5ad-9a066684ddad","uri":"","name":"*.bendigoadelaide.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"53ad34be-bdfa-4040-9bcb-a318e81c0a24","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"09e0ebbe-b2d5-42ef-b5ad-9a066684ddad"}],"recentChangeFlags":null},{"id":"22035279-8516-4e6d-b321-bd1b713233a2","uri":"","name":"*.bendigobank.net.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ce6c43a9-d0bb-4be0-8eb9-cb1db04f50a7","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"22035279-8516-4e6d-b321-bd1b713233a2"}],"recentChangeFlags":null},{"id":"525cf194-1452-44cd-a026-8ab48b2d7938","uri":"","name":"*.benbank.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5d23d8fd-ee6d-4a44-86d9-6c887fd3ff6d","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"525cf194-1452-44cd-a026-8ab48b2d7938"}],"recentChangeFlags":null},{"id":"c96cfe37-2234-4410-a4c0-d50bbde24b2c","uri":"https://apps.apple.com/au/app/bendigo-bank/id482844929?ign-mpt=uo%3D4","name":"Bendigo Bank - iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"76fa84af-2164-48b3-9318-5a58397f06d6","sortOrder":5},"sortOrder":5,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"c96cfe37-2234-4410-a4c0-d50bbde24b2c"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"c96cfe37-2234-4410-a4c0-d50bbde24b2c"}],"recentChangeFlags":null},{"id":"f107208b-a66a-4ab4-8d43-254194bfdbeb","uri":"https://play.google.com/store/apps/details?id=com.bendigobank.mobile","name":"Bendigo Bank - Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"56ab6567-f3ab-44ce-b33c-a91c7c3d2e23","sortOrder":6},"sortOrder":6,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"f107208b-a66a-4ab4-8d43-254194bfdbeb"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"f107208b-a66a-4ab4-8d43-254194bfdbeb"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"37f28f34-1f5e-4370-abba-c583d4425f8e","name":"Up Bank","targets":[{"id":"bee2a121-7711-48b9-99d5-574a072a5d92","uri":"","name":"*.up.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3a14e23a-a0ec-43b3-82b4-1fcc33122d59","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bee2a121-7711-48b9-99d5-574a072a5d92"}],"recentChangeFlags":null},{"id":"bb6e4f5f-7933-4a50-8f0b-7b19990e805e","uri":"","name":"*.upmoney.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"745eec15-515f-4679-9de3-56268954484d","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bb6e4f5f-7933-4a50-8f0b-7b19990e805e"}],"recentChangeFlags":null},{"id":"7497424a-d2b3-4756-a358-1f4091b8bb13","uri":"","name":"*.updev.net","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"30e167e8-51d6-4277-b422-964c102ff7e0","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7497424a-d2b3-4756-a358-1f4091b8bb13"}],"recentChangeFlags":null},{"id":"16865e7a-bbbd-4033-b07a-5afcde6792e9","uri":"https://apps.apple.com/au/app/up-easy-money/id1350717115","name":"Up - iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9a2287e8-d262-46d5-9e8d-860c01f46c6a","sortOrder":3},"sortOrder":3,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"16865e7a-bbbd-4033-b07a-5afcde6792e9"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"16865e7a-bbbd-4033-b07a-5afcde6792e9"}],"recentChangeFlags":null},{"id":"13e77027-61ce-485d-be79-e12d17253eb7","uri":"https://play.google.com/store/apps/details?id=au.com.up.money\u0026hl=en-US","name":"Up - Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7dae15d7-06a4-453d-9a66-4778950d3184","sortOrder":4},"sortOrder":4,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"13e77027-61ce-485d-be79-e12d17253eb7"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"13e77027-61ce-485d-be79-e12d17253eb7"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eUp, also known as Up Money and Up Banking, is an Australian neobank. \u003c/p\u003e\n\n\u003cp\u003eUp was founded in 2018 as a collaboration between software company Ferocia and Bendigo \u0026amp; Adelaide Bank.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"218e3e1b-e298-4153-936f-153e2c0bde80","name":"Additional Web Targets","targets":[{"id":"fec8d76b-9761-4a84-b67b-a19dfd8f8ccf","uri":"","name":"*.cbnc.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f8aebe9c-74d2-4f9d-8a48-a627267d53a5","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fec8d76b-9761-4a84-b67b-a19dfd8f8ccf"}],"recentChangeFlags":null},{"id":"b1834698-8ebd-439d-8be7-fa8a01d27522","uri":"","name":"*.delphibank.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"99693bfc-1f75-4c98-9425-11f4ec443d4e","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b1834698-8ebd-439d-8be7-fa8a01d27522"}],"recentChangeFlags":null},{"id":"6a3393f1-473d-4a2e-bed7-249ca8420e42","uri":"","name":"*.ferocia.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e288bf0b-b0bf-40a6-b760-4419d1f7ffdb","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6a3393f1-473d-4a2e-bed7-249ca8420e42"}],"recentChangeFlags":null},{"id":"5cc64d18-6104-4a59-bf3b-3dbf1b50ccb5","uri":"","name":"*.leveraged.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a0664bad-ecb7-4b97-bee8-5393c73aa010","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5cc64d18-6104-4a59-bf3b-3dbf1b50ccb5"}],"recentChangeFlags":null},{"id":"66aa0e86-5bc1-4a75-ae63-84e843339128","uri":"","name":"*.leverageonline.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"84294461-4bfd-48a4-9f32-39b9d57f3f33","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"66aa0e86-5bc1-4a75-ae63-84e843339128"}],"recentChangeFlags":null},{"id":"6cf42ca2-7e4f-464c-ad6b-f0d75ad4c877","uri":"","name":"*.marginlending.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bd4c5fd7-eccd-46a2-9393-7ee3912350dd","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6cf42ca2-7e4f-464c-ad6b-f0d75ad4c877"}],"recentChangeFlags":null},{"id":"883bcbb8-19d0-46dd-b505-57dcfc08677c","uri":"","name":"*.marginlending.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"807464cd-8f8c-49f6-8d47-dce0b1cea540","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"883bcbb8-19d0-46dd-b505-57dcfc08677c"}],"recentChangeFlags":null},{"id":"8dadf459-008d-4e94-8a65-d6e489cd50b7","uri":"","name":"*.profarmergrain.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b7013bea-bc63-4dd4-a223-3bade1f4b277","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8dadf459-008d-4e94-8a65-d6e489cd50b7"}],"recentChangeFlags":null},{"id":"2236576f-d38e-4e9d-ab49-36b6f28aad7f","uri":"","name":"*.ruralfinance.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a9457ee2-3a13-4102-80a0-580a524339f1","sortOrder":8},"sortOrder":8,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2236576f-d38e-4e9d-ab49-36b6f28aad7f"}],"recentChangeFlags":null},{"id":"534e808d-b24d-4c6c-9408-bafff3780a7e","uri":"","name":"*.sandhursttrustees.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1fa57d49-1427-404f-a13a-a55209851f40","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"534e808d-b24d-4c6c-9408-bafff3780a7e"}],"recentChangeFlags":null},{"id":"4948d31c-879e-48c2-9f2b-7ba138eac6b5","uri":"","name":"*.profarmer.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"072d8528-5c6e-4193-ba37-2174e39d1880","sortOrder":10},"sortOrder":10,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4948d31c-879e-48c2-9f2b-7ba138eac6b5"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"991f9a22-7b7f-46c6-80b2-877dd1a8078f","code":"bendigobank-vdp","state":"in_progress","endsAt":null,"bountyId":"31471906-0933-4a73-b5b6-7b02a8e1e86f","startsAt":"2025-07-15T06:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Banking","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/39be/421b/321fd574/1c01377289618cb8c1fedb2b7c3f538f_bendigobank_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-07-15T06:00:00.498Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/bendigobank-vdp","changelogs":"/engagements/bendigobank-vdp/changelog","submissions":null,"announcements":"/engagements/bendigobank-vdp/announcements","hallOfFame":"/engagements/bendigobank-vdp/hall_of_fames","crowdstream":"/engagements/bendigobank-vdp/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/bendigobank-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=bendigobank-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/bendigobank-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/bendigobank-vdp/changelog","publishedAt":"2026-09-17T04:27:18.324Z","engagementChangelogUrl":"/engagements/bendigobank-vdp/changelog/4ad9133f-71cb-49fe-af21-7281256de830","createUserFeedbacksUrl":"/engagements/bendigobank-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/bendigobank-vdp/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}