{"id":"b92e72cb-9de5-45fb-aa47-8164f4056a64","engagementId":"0d30815a-a36d-4068-956f-eea169061931","data":{"brief":{"id":"6c04a1fc-0115-4772-b755-fe11b3277191","name":"BitGo Managed Public Bug Bounty Engagement ","tagline":"BitGo offers secure, scalable solutions for the digital asset economy, including regulated custody, borrowing, lending, and core infrastructure for investors and builders.","description":"\u003cp\u003eBitGo provides the most secure and scalable solutions for the digital asset economy, offering regulated custody, borrowing and lending, and core infrastructure to investors and builders alike. Founded in 2013 — the early days of crypto — BitGo pioneered the multi-signature wallet and later built TSS to improve upon other companies’ MPC offerings. Between multi-sig and TSS, BitGo offers the safest technology on the market and safeguards over 600 tokens across a wide variety of blockchains. Over the years, BitGo has expanded from offering wallets into providing a full-suite solution that lets clients hold assets safely and then put them to work.\u003c/p\u003e\n\n\u003cp\u003eToday, BitGo is the leader in digital asset security, custody, and liquidity, providing the operational backbone for more than 700 institutional clients in over 50 countries — a list that includes many regulated entities and the world’s top cryptocurrency exchanges and platforms. BitGo also processes approximately 20% of all global Bitcoin transactions by value.\u003c/p\u003e\n\n\u003cp\u003eWe're looking for passionate and driven researchers who can help us keep our platform secure and join us on our mission. \u003c/p\u003e\n\n\u003cp\u003eGood luck and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of BitGo not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to BitGo, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eIf you discover credentials during testing in our program, cease testing immediately. Do not attempt to validate their functionality. Instead, submit a report containing the identified credentials, specify the location where they were found, and indicate if there is potential for additional Personally Identifiable Information (PII) in that location. Accessing accounts that you do not own is a violation of our code of conduct and will result in immediate removal from the program. There is no guarantee of a reward for these submissions.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eVulnerabilities involving leaked credentials will be reviewed on a case by case basis. Please note this includes leaked credentials from third parties only: this includes credential dumps found on websites, leaked credentials from indirect sources other than the listed in scope targets. There is no guarantee of a reward for these submissions.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess/Credentials\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTraffic Identification\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior: X-Bug-Bounty: Bugcrowd-\u0026lt;Username\u0026gt;\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":"\u003cp\u003eThe following individuals are not eligible to participate in our bug bounty program:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCurrent full-time, part-time, temporary, or contract employees, interns\u003c/li\u003e\n\u003cli\u003eFormer employees who have left the organization within the past 12 months\u003c/li\u003e\n\u003cli\u003eImmediate family members of current employees\u003c/li\u003e\n\u003cli\u003eVendors and contractors who have access to our source code or internal systems\u003c/li\u003e\n\u003c/ul\u003e"},"scope":[{"id":"304c0c3e-92ed-45a9-996a-62d308aad3e6","name":"In Scope","targets":[{"id":"cb61d871-ac08-4c55-9547-43fa3555c275","uri":"","name":"*.bitgo.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"86687e06-b0d4-49c1-9542-4ff7c2aa6854","sortOrder":0},"sortOrder":0,"tags":[{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"cb61d871-ac08-4c55-9547-43fa3555c275"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cb61d871-ac08-4c55-9547-43fa3555c275"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"cb61d871-ac08-4c55-9547-43fa3555c275"}],"recentChangeFlags":null},{"id":"4438aad0-ab44-4b91-82b6-2363ed360110","uri":"https://app.bitgo.com","name":"app.bitgo.com ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"138e9b72-65b9-4d2c-9ba9-9e98290794f5","sortOrder":1},"sortOrder":1,"tags":[{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"4438aad0-ab44-4b91-82b6-2363ed360110"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4438aad0-ab44-4b91-82b6-2363ed360110"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"4438aad0-ab44-4b91-82b6-2363ed360110"}],"recentChangeFlags":null},{"id":"f4f5fb39-af26-4a33-9646-1faefe7cc7b5","uri":"https://app.bitgo-test.com","name":"app.bitgo-test.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8b7fae05-f67d-4c85-a6cc-d09228c9f4c6","sortOrder":2},"sortOrder":2,"tags":[{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"f4f5fb39-af26-4a33-9646-1faefe7cc7b5"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f4f5fb39-af26-4a33-9646-1faefe7cc7b5"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"f4f5fb39-af26-4a33-9646-1faefe7cc7b5"}],"recentChangeFlags":null},{"id":"128c9229-4b14-443b-b374-9e2dae58f82d","uri":"https://bitgo.ae/","name":"bitgo.ae","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"12259d96-955d-4e10-b250-abb9c4698d76","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"128c9229-4b14-443b-b374-9e2dae58f82d"}],"recentChangeFlags":null},{"id":"90a91381-7fa0-42d6-883f-efa6975c005b","uri":"https://usdstandard.com/","name":"usdstandard.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4469351b-2084-4408-a7a2-14f7e701ab9e","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"90a91381-7fa0-42d6-883f-efa6975c005b"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"1a131210-8b21-4809-a1fe-8fe98eb05b3f","p1MaxCents":450000,"p1MinCents":350000,"p2MaxCents":250000,"p2MinCents":150000,"p3MaxCents":75000,"p3MinCents":50000,"p4MaxCents":22500,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eapp.bitgo.com\u003c/strong\u003e - hosts the Web application that is used by BitGo customers to login to and use the BitGo Platform\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eapp.bitgo-test.com\u003c/strong\u003e - Equivalent of the production web application in the Test Environment\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eNote: The test environment allows \u0026quot;000000\u0026quot; as the 2FA token\u003c/em\u003e\u003cbr\u003e\n\u003cem\u003eTesting rate limits is not in scope for any target\u003c/em\u003e\u003cbr\u003e\n\u003cem\u003ePasskey is currently in the testing phase and is not in scope\u003c/em\u003e\u003c/p\u003e","rewardRangeData":{"1":{"min":3500,"max":4500},"2":{"min":1500,"max":2500},"3":{"min":500,"max":750},"4":{"min":100,"max":225},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"0d30815a-a36d-4068-956f-eea169061931","code":"bitgo-mbb-og-public","state":"in_progress","endsAt":null,"bountyId":"7f3bd865-dba4-4b27-af12-d2330efedb1f","startsAt":"2024-10-01T14:12:01Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/3247/aa28/654fcb53/1652b0cca1522011e5bd40ae0023656c_Shield_Logo_Blue-Dark.png","logoBackgroundColor":"#2a2d40","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-10-01T14:12:01.259Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/bitgo-mbb-og-public","changelogs":"/engagements/bitgo-mbb-og-public/changelog","submissions":null,"announcements":"/engagements/bitgo-mbb-og-public/announcements","hallOfFame":"/engagements/bitgo-mbb-og-public/hall_of_fames","crowdstream":"/engagements/bitgo-mbb-og-public/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/bitgo-mbb-og-public/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=bitgo-mbb-og-public\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/bitgo-mbb-og-public/engagement_subscribers","engagementChangelogsUrl":"/engagements/bitgo-mbb-og-public/changelog","publishedAt":"2026-06-17T18:53:57.489Z","engagementChangelogUrl":"/engagements/bitgo-mbb-og-public/changelog/b92e72cb-9de5-45fb-aa47-8164f4056a64","createUserFeedbacksUrl":"/engagements/bitgo-mbb-og-public/feedbacks","engagementCrowdstreamUrl":"/engagements/bitgo-mbb-og-public/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}