{"id":"9bf33fae-cd6c-4a53-8ef9-676bbc42ba37","engagementId":"ff6fb8f3-a303-44c5-b9c9-db37800530b7","data":{"brief":{"id":"88eef036-f381-4f2f-bbd8-cb22fd7acc33","name":"BitGo Mobile Apps Bug Bounty Engagement ","tagline":"BitGo offers secure, scalable solutions for the digital asset economy, including regulated custody, borrowing, lending, and core infrastructure for investors and builders.","description":"\u003cp\u003eBitGo provides the most secure and scalable solutions for the digital asset economy, offering regulated custody, borrowing and lending, and core infrastructure to investors and builders alike. Founded in 2013, the early days of crypto, BitGo pioneered the multi-signature wallet and later built TSS to improve upon other companies’ MPC offerings. Between multi-sig and TSS, BitGo offers the safest technology on the market and safeguards over 600 tokens across a wide variety of blockchains. Over the years, BitGo has expanded from offering wallets into providing a full-suite solution that lets clients hold assets safely and then put them to work.\u003c/p\u003e\n\n\u003cp\u003eToday, BitGo is the leader in digital asset security, custody, and liquidity, providing the operational backbone for more than 700 institutional clients in over 50 countries — a list that includes many regulated entities and the world’s top cryptocurrency exchanges and platforms. BitGo also processes approximately 20% of all global Bitcoin transactions by value.\u003c/p\u003e\n\n\u003cp\u003eThis bug bounty program targets the pending approval workflow in BitGo’s mobile application. In organizational crypto operations, sensitive actions require review and approval by multiple parties before execution in production. These include Transactions, User management, Policy updates. The mobile app enables approvers to review and take action on these pending approvals directly from their devices.\u003c/p\u003e\n\n\u003cp\u003eWe are looking for passionate and driven researchers who can help us keep our platform secure and join us on our mission. \u003c/p\u003e\n\n\u003cp\u003eGood luck and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of BitGo not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to BitGo, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eEngagement Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou are testing in a production environment. Do not attempt to access any accounts that you do not own.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eReport Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eReports must contain a clear explanation of the issue and the security impact along with detailed steps to reproduce it. If the issue cannot be reliably reproduced based on your report, it may be considered ineligible for a reward.\u003c/li\u003e\n\u003cli\u003eDo not submit more than one vulnerability per report. In cases where demonstrating impact requires chaining multiple vulnerabilities together, those can be included in the same report as long as the linkage is clearly explained.\u003c/li\u003e\n\u003cli\u003eWe do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human input will be rejected.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess/Credentials\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTraffic Identification\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior: X-Bug-Bounty: Bugcrowd-\u0026lt;Username\u0026gt;\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eTrusted Device Management\u003c/li\u003e\n\u003cli\u003ePasskey creation and usage\u003c/li\u003e\n\u003cli\u003e2FA + TOTP addition and usage\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eP5 vulnerabilities\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvailability/volumetric testing e.g.:\n\n\u003cul\u003e\n\u003cli\u003eDoS/DDoS/Network DoS\u003c/li\u003e\n\u003cli\u003eRate limiting bypass attempts\u003c/li\u003e\n\u003cli\u003eEmail bombing flooding\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eALL forms of social Engineering\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eN-day/Third party 0-day Policy\u003c/h2\u003e\n\n\u003cp\u003eWhen N-Day bugs are released to the public, we will consider these as in scope after 14 days have gone by\u003cbr\u003e\ne.g: N-day released on January 1st, we would consider it in-scope on January 15th.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"7cd55f18-47c2-40d8-9b46-4cec0f6499d9","name":"In Scope","targets":[{"id":"7bb26a40-9375-408e-b681-3b30d358978b","uri":"https://play.google.com/store/apps/details?id=com.bitgo.verify\u0026hl=en_US","name":"BitGo Verify Mobile App (Android)","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"01a09fb0-8082-42d6-a0f2-bd93d858bc78","sortOrder":0},"sortOrder":0,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"7bb26a40-9375-408e-b681-3b30d358978b"},{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"7bb26a40-9375-408e-b681-3b30d358978b"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"7bb26a40-9375-408e-b681-3b30d358978b"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"7bb26a40-9375-408e-b681-3b30d358978b"}],"recentChangeFlags":null},{"id":"fed9cc13-3a83-4990-8bbf-3ac33185dcc7","uri":"https://apps.apple.com/us/app/bitgo-verify/id1608937235","name":"BitGo Verify Mobile App (iOS)","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5adaf4a2-8777-4271-86c8-f33cec5188f5","sortOrder":1},"sortOrder":1,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"fed9cc13-3a83-4990-8bbf-3ac33185dcc7"},{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"fed9cc13-3a83-4990-8bbf-3ac33185dcc7"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"fed9cc13-3a83-4990-8bbf-3ac33185dcc7"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"fed9cc13-3a83-4990-8bbf-3ac33185dcc7"}],"recentChangeFlags":null},{"id":"8ed5db1f-720c-4fee-bc5e-869d890213a2","uri":"https://play.google.com/store/apps/details?id=com.bitgo.mobileapp","name":"BitGo Platform Access Mobile App (Android)","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"42514e11-4ca0-499e-a22e-d73c9449e883","sortOrder":2},"sortOrder":2,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"8ed5db1f-720c-4fee-bc5e-869d890213a2"},{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"8ed5db1f-720c-4fee-bc5e-869d890213a2"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"8ed5db1f-720c-4fee-bc5e-869d890213a2"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"8ed5db1f-720c-4fee-bc5e-869d890213a2"}],"recentChangeFlags":null},{"id":"c9d2a0cc-78d3-48f7-98d5-242c947344f5","uri":"https://apps.apple.com/us/app/bitgo/id6739010408","name":"BitGo Platform Access Mobile App (iOS)","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7b421731-2a2f-4791-be3f-88c40aaa3417","sortOrder":3},"sortOrder":3,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"c9d2a0cc-78d3-48f7-98d5-242c947344f5"},{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"c9d2a0cc-78d3-48f7-98d5-242c947344f5"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"c9d2a0cc-78d3-48f7-98d5-242c947344f5"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"c9d2a0cc-78d3-48f7-98d5-242c947344f5"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"48acfae9-ac88-4dac-8e90-f08b748e79f0","p1MaxCents":450000,"p1MinCents":350000,"p2MaxCents":250000,"p2MinCents":150000,"p3MaxCents":75000,"p3MinCents":50000,"p4MaxCents":22500,"p4MinCents":17500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eTarget Description\u003c/h2\u003e\n\n\u003cp\u003eOur mobile applications play a critical role in enabling seamless user interactions. They are designed to support a wide range of functionalities, ensuring that users can perform essential tasks anytime, anywhere.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eBitGo Verify Primary Supported Testing Regions\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eiOS: United States, Singapore\u003c/li\u003e\n\u003cli\u003eAndroid: United States, Singapore, and EU regions including Poland \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eBitGo Platform Primary Supported Testing Regions\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eiOS: All regions except India, Ukraine, Russia, Belarus, and Afghanistan\u003c/li\u003e\n\u003cli\u003eAndroid: All regions \u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":3500,"max":4500},"2":{"min":1500,"max":2500},"3":{"min":500,"max":750},"4":{"min":175,"max":225},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"d8e8dd1a-99cc-46fb-9fe3-7d8b6b288b9f","name":"Out of Scope ","targets":[{"id":"cb61d871-ac08-4c55-9547-43fa3555c275","uri":"","name":"*.bitgo.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b5b7ddcc-0ad7-4716-932f-3fa29fac888f","sortOrder":0},"sortOrder":0,"tags":[{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"cb61d871-ac08-4c55-9547-43fa3555c275"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cb61d871-ac08-4c55-9547-43fa3555c275"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"cb61d871-ac08-4c55-9547-43fa3555c275"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"ff6fb8f3-a303-44c5-b9c9-db37800530b7","code":"bitgo-mobileapps-mbb-og","state":"in_progress","endsAt":null,"bountyId":"7f3bd865-dba4-4b27-af12-d2330efedb1f","startsAt":"2025-09-11T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/3247/aa28/654fcb53/1652b0cca1522011e5bd40ae0023656c_Shield_Logo_Blue-Dark.png","logoBackgroundColor":"#2a2d40","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-09-11T18:00:00.688Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/bitgo-mobileapps-mbb-og","changelogs":"/engagements/bitgo-mobileapps-mbb-og/changelog","submissions":null,"announcements":"/engagements/bitgo-mobileapps-mbb-og/announcements","hallOfFame":"/engagements/bitgo-mobileapps-mbb-og/hall_of_fames","crowdstream":"/engagements/bitgo-mobileapps-mbb-og/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/bitgo-mobileapps-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=bitgo-mobileapps-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/bitgo-mobileapps-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/bitgo-mobileapps-mbb-og/changelog","publishedAt":"2026-08-12T18:16:23.068Z","engagementChangelogUrl":"/engagements/bitgo-mobileapps-mbb-og/changelog/9bf33fae-cd6c-4a53-8ef9-676bbc42ba37","createUserFeedbacksUrl":"/engagements/bitgo-mobileapps-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/bitgo-mobileapps-mbb-og/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}