{"id":"aa9c15b3-c6b6-44a0-818d-e3f748e4aab0","engagementId":"09a71606-59d0-4f36-8a10-ceccdfc2875c","data":{"brief":{"id":"d524da96-6892-48fc-9447-cc9ba42a1fa0","name":"Bitso Managed Bug Bounty Engagement","tagline":"Bitso is Latin America’s leading Financial Services company powered by crypto.","description":"\u003cp\u003eBitso is Latin America’s leading Financial Services company powered by crypto. With millions of clients, we are leading the financial revolution with borderless, secure, transparent, and accessible financial products. With the mission to unlock the power of borderless, secure, and easy-to-use financial products by making crypto useful, we are committed to empowering the region with universal access to the digital economy of the future and enabling a fairer monetary system.\u003c/p\u003e\n\n\u003cp\u003eNo technology is perfect and Bitso believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eGood luck, and happy hunting!\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Bitso not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Bitso, you can report it to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/home\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Portal\u003c/a\u003e. However, be aware that such reports will be ineligible for rewards or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cp\u003eWe're particularly interested in reports covering:\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eAccess control vulnerabilities\u003c/strong\u003e — accessing data or functionality that belongs to another user or account (IDOR, broken object-level authorization, etc.).\u003cbr\u003e\n\u003cstrong\u003ePrivilege escalation\u003c/strong\u003e — vertical or horizontal, including moving from a retail account to admin or internal functionality.\u003cbr\u003e\n\u003cstrong\u003eAuthentication weaknesses\u003c/strong\u003e — 2FA bypass, session handling flaws, account takeover vectors, password reset flaws.\u003cbr\u003e\n\u003cstrong\u003eBusiness logic flaws in financial flows\u003c/strong\u003e — anything that lets you manipulate balances, trades, deposits, withdrawals, or conversion rates in ways the platform shouldn't allow.\u003cbr\u003e\n\u003cstrong\u003eRace conditions\u003c/strong\u003e — especially around transactions, transfers, and balance updates.\u003cbr\u003e\n\u003cstrong\u003eKYC/onboarding bypass\u003c/strong\u003e — skipping or spoofing identity verification steps.\u003cbr\u003e\n\u003cstrong\u003eAPI vulnerabilities\u003c/strong\u003e — broken authorization, excessive data exposure, or rate-limit issues with demonstrated impact on our public and mobile APIs.\u003c/p\u003e\n\n\u003cp\u003eFindings that demonstrate direct impact on customer funds or personal data will be prioritized and rated accordingly.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope Vulnerabilities\u003c/h2\u003e\n\n\u003cp\u003eWe can only reward findings on systems that Bitso actually owns and operates. The following issue types are out of scope for this program:\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eSupply chain attacks\u003c/strong\u003e — compromised third-party dependencies, development tools, IDE extensions, packages, or vendors used by Bitso or its employees, including cases where an employee is targeted directly through one of these. Even if the end result exposes Bitso information, the root cause lives outside our environment and is not a vulnerability in our systems.\u003cbr\u003e\n\u003cstrong\u003eSocial engineering\u003c/strong\u003e — phishing, vishing, smishing, or similar attacks against employees or customers.\u003cbr\u003e\n\u003cstrong\u003ePhysical attacks\u003c/strong\u003e — against offices, data centers, or personnel.\u003cbr\u003e\n\u003cstrong\u003eDoS/DDoS and brute-forcing\u003c/strong\u003e — see the Access/Traffic Identification section above.\u003cbr\u003e\n\u003cstrong\u003eThird-party services\u003c/strong\u003e — issues in services we use but don't operate. Please report those to the vendor.\u003cbr\u003e\n\u003cstrong\u003eBest-practice findings with no demonstrated impact\u003c/strong\u003e — missing headers, SPF/DKIM/DMARC records, version disclosure, self-XSS, and similar.\u003cbr\u003e\n\u003cstrong\u003eScanner output\u003c/strong\u003e — raw automated scanner results without a working proof of concept.\u003c/p\u003e\n\n\u003cp\u003eYou're still welcome to send these our way for awareness, and we appreciate the heads up — but they won't qualify for rewards or points-based compensation.\u003c/p\u003e\n\n\u003ch2\u003eCredentials\u003c/h2\u003e\n\n\u003cp\u003eAccounts on all publicly facing targets can be self-provisioned. Please sign up for an account using your @\u003ca href=\"http://bugcrowdninja.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ebugcrowdninja.com\u003c/a\u003e email address as they will be automatically approved and will allow for testing of all features without needing to make a payment. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch3\u003eAccess/Traffic Identification\u003c/h3\u003e\n\n\u003cp\u003eTargets are accessible via the public internet. When accessing, please add the below request header. DDoS and Bruteforcing are highly discouraged and testing without the below header can lead to account blockage and IP ban since it will be considered a legitimate attack.\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eIdentifier\u003c/th\u003e\n\u003cth\u003eHeader\u003c/th\u003e\n\u003cth\u003eExample\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eUsername\u003c/td\u003e\n\u003ctd\u003eX-Bug-Bounty: Bugcrowd-\u0026lt;Username\u0026gt;\u003c/td\u003e\n\u003ctd\u003eX-Bug-Bounty: Bugcrowd-proresearcher\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eCross-Domain Duplicate Policy\u003c/h2\u003e\n\n\u003cp\u003ePlease note that \u003ccode\u003ebitso.com\u003c/code\u003e, \u003ccode\u003envio.mx\u003c/code\u003e, and \u003ccode\u003envio.ar\u003c/code\u003e are considered a single logical entity for the purposes of this program.\u003c/p\u003e\n\n\u003cp\u003eVulnerabilities identified on these domains that originate from the same underlying code, configuration, or database will be treated as a \u003cstrong\u003esingle finding.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eThe first report received (\u003cem\u003eon any of these domains\u003c/em\u003e) will be considered the original; subsequent reports on a sibling domain will be closed as \u003ccode\u003eDuplicate\u003c/code\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003e\u003cstrong\u003eNote: Researchers are encouraged to note if a vulnerability affects multiple domains within a single report.\u003c/strong\u003e\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eN-Day Policy\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eWhen N-Day bugs are released to the public, we will consider these as in scope \u003cem\u003eafter\u003c/em\u003e 14 days have gone by\n\n\u003cul\u003e\n\u003cli\u003ee.g: N-day released on 01/01/2025, we would consider it in-scope on 01/15/2025\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eThe Fine Print\u003c/h2\u003e\n\n\u003cp\u003eYou must comply with all applicable laws in connection with your participation in this program. You are also responsible for any applicable taxes associated with any reward you receive.\u003c/p\u003e\n\n\u003cp\u003eThank you for helping keep the crypto community safe!\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"5b981034-0f38-4b85-946b-4249ededc2c4","name":"In Scope","targets":[{"id":"8b70c686-1a96-4895-976f-37d938c028cf","uri":"https://bitso.com","name":"bitso.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"dbe95202-88a4-4e4c-b7c2-e04ba63a313b","sortOrder":0},"sortOrder":0,"tags":[{"id":"16818e15-ac0f-4e76-999b-8b6a87db2837","name":"Docker","targetId":"8b70c686-1a96-4895-976f-37d938c028cf"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"8b70c686-1a96-4895-976f-37d938c028cf"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"8b70c686-1a96-4895-976f-37d938c028cf"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"8b70c686-1a96-4895-976f-37d938c028cf"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8b70c686-1a96-4895-976f-37d938c028cf"},{"id":"e82bba17-848b-4f2b-a2a5-58d2a83530d4","name":"Kubernetes","targetId":"8b70c686-1a96-4895-976f-37d938c028cf"}],"recentChangeFlags":null},{"id":"4728cd48-b5ca-44e5-8c8a-6f1bdbd05b5b","uri":"https://nvio.mx/","name":"https://nvio.mx/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3223ec12-bd8f-494d-bb2c-8d21bf30c48d","sortOrder":1},"sortOrder":1,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"4728cd48-b5ca-44e5-8c8a-6f1bdbd05b5b"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"4728cd48-b5ca-44e5-8c8a-6f1bdbd05b5b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4728cd48-b5ca-44e5-8c8a-6f1bdbd05b5b"}],"recentChangeFlags":null},{"id":"9a86280c-6e64-4124-93e6-1be9ed67ef1b","uri":"https://nvio.ar/","name":"https://nvio.ar/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"820b3c57-66d7-4b92-9d8f-cbe2da997155","sortOrder":2},"sortOrder":2,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"9a86280c-6e64-4124-93e6-1be9ed67ef1b"},{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"9a86280c-6e64-4124-93e6-1be9ed67ef1b"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"9a86280c-6e64-4124-93e6-1be9ed67ef1b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9a86280c-6e64-4124-93e6-1be9ed67ef1b"}],"recentChangeFlags":null},{"id":"3aaf0f1b-2c71-4daa-91fa-acd62c4a97d0","uri":"https://apps.apple.com/us/app/bitso-buy-bitcoin-easily/id1292836438","name":"Mobile App Bitso Wallet iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1fe5be11-4af0-4fb1-afe8-ba507647027e","sortOrder":3},"sortOrder":3,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"3aaf0f1b-2c71-4daa-91fa-acd62c4a97d0"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"3aaf0f1b-2c71-4daa-91fa-acd62c4a97d0"}],"recentChangeFlags":null},{"id":"169e0253-9650-4c51-932e-03bb6d5987f4","uri":"https://apps.apple.com/us/app/bitso-alpha-crypto-trade-pro/id1539469172","name":"Mobile App Bitso Alpha iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4778d293-5cff-4d0b-9ce4-600ee2b152d9","sortOrder":4},"sortOrder":4,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"169e0253-9650-4c51-932e-03bb6d5987f4"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"169e0253-9650-4c51-932e-03bb6d5987f4"}],"recentChangeFlags":null},{"id":"657e17e9-dd00-4e12-8ae0-5392fe551651","uri":"https://play.google.com/store/apps/details?id=com.bitso.wallet\u0026pcampaignid=web_share","name":"Mobile App Bitso Wallet Android","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"80200f73-8048-4ba4-9b8b-c4d79b937802","sortOrder":5},"sortOrder":5,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"657e17e9-dd00-4e12-8ae0-5392fe551651"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"657e17e9-dd00-4e12-8ae0-5392fe551651"}],"recentChangeFlags":null},{"id":"d6a2a6c5-569b-4f4f-80ed-761299000f26","uri":"https://play.google.com/store/apps/details?id=com.bitso.alpha","name":"Mobile App Bitso Alpha Android","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"161b68d1-7715-49cb-a2b5-f0384d0efcc0","sortOrder":6},"sortOrder":6,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"d6a2a6c5-569b-4f4f-80ed-761299000f26"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"d6a2a6c5-569b-4f4f-80ed-761299000f26"}],"recentChangeFlags":null},{"id":"139534e2-1505-41fd-b99e-a7684b63f19c","uri":"https://onchain.cc/","name":"onchain.cc","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e5ba6013-40fc-4b13-be1d-a1f85d4bc236","sortOrder":7},"sortOrder":7,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"139534e2-1505-41fd-b99e-a7684b63f19c"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"139534e2-1505-41fd-b99e-a7684b63f19c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"139534e2-1505-41fd-b99e-a7684b63f19c"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"139534e2-1505-41fd-b99e-a7684b63f19c"}],"recentChangeFlags":["entirely_new"]}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"815b4e4f-6705-4b13-9fb2-6a5f61f2ef69","p1MaxCents":750000,"p1MinCents":550000,"p2MaxCents":350000,"p2MinCents":250000,"p3MaxCents":150000,"p3MinCents":75000,"p4MaxCents":50000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch4\u003eBitso.com - Bitso is a cryptocurrency platform that enables users to invest, trade, and make borderless payments using digital assets. With over 8 million users globally, it offers a range of services tailored to both individuals and businesses. Key Features: Cryptocurrency Trading, Earnings Program, Investment Tools, Bitso Card, Business Solutions.\u003c/h4\u003e\n\n\u003ch4\u003eBitso Mobile -\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eCurrently the applications are being developed natively. Therefore they don\u0026#39;t share codebase nor framework so all submissions will be considered unique for both apps on iOS and Android. \u003c/li\u003e\n\u003cli\u003eHackers are encouraged to use the applications version found in the App Stores.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eApps -\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eBitso Wallet - The Bitso Wallet app allows users to manage their cryptocurrency investments, trade digital assets, and make payments directly from their mobile devices.\u003c/li\u003e\n\u003cli\u003eBitso Alpha - Bitso Alpha is a professional trading platform offered by Bitso, designed for users who require advanced tools and features for cryptocurrency trading.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":5500,"max":7500},"2":{"min":2500,"max":3500},"3":{"min":750,"max":1500},"4":{"min":50,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"cf9bb732-5029-42e3-875a-f1969e93ee80","name":"Out of Scope","targets":[{"id":"a2ea02f1-6821-4b67-b14e-4ee8a629630c","uri":"","name":"help.bitso.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5f0b8a19-451c-4e83-bdd1-d5430b559fb5","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"12e1223c-1fef-4390-b310-799cc0f03da0","uri":"","name":"status.bitso.com\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7e7f56f3-d5b4-4519-a53d-ddff1a0dd51b","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"5414e6f5-6744-4ff2-bb44-0187fc4f26d0","uri":"","name":"dev.bitso.com\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a967ce4e-2716-4230-b095-bd0a7d5b032e","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"41d8a51c-16dd-447a-95b2-4fdc85153507","uri":"","name":"blog.bitso.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e0b7f343-357e-4c4d-8eae-b8088974103b","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"40886fa0-57ba-45c0-bd07-ac5a93791eb2","uri":"","name":"stage.bitso.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fcf00539-57f3-48e8-952b-f521b8c55de9","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"b00dad90-f5a8-4731-90ba-8357eaea7186","uri":"","name":"landing.bitso.com\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a0085537-5520-4f32-8d05-30d213f9d407","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"24f14ea2-53d5-4411-a0ae-b4bd3a570981","uri":"","name":"devmalta.bitso.com\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f235ef1d-0799-4e15-9967-8bd009c0d029","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"7aae28e9-5a34-4c93-b8a9-78556836b954","uri":"","name":"edu.bitso.com\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3956a515-76f4-43e6-8943-639306d602d0","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null},{"id":"e4e0bc33-d895-490e-b7ad-18d02a218f97","uri":"","name":"sandbox.bitso.com\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a3bb8e51-1ecb-418a-aba4-b14fbec94e8d","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null},{"id":"9efd0bfe-231b-4836-b934-214a78e4fcb7","uri":"","name":"api-dev.bitso.com\t","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9c589948-2e67-4988-98e4-5a5851d670b0","sortOrder":9},"sortOrder":9,"tags":null,"recentChangeFlags":null},{"id":"7f68660e-4a4e-40cf-b87f-6fc77edc6a2d","uri":"","name":"api-stage.bitso.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9c55d74e-ec8e-4f07-95ef-f2edee7fea98","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null},{"id":"12f58b08-6c9b-4a46-a505-0ff90f90648c","uri":"","name":"api-sandbox.bitso.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d38506c2-094c-49c9-9059-054603a08d7f","sortOrder":11},"sortOrder":11,"tags":null,"recentChangeFlags":null},{"id":"2498159a-3cf9-4133-a326-44a428459729","uri":"","name":"stagemalta.bitso.com\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"57041106-11b5-4930-85f8-b7666f01f059","sortOrder":12},"sortOrder":12,"tags":null,"recentChangeFlags":null},{"id":"c56de1b6-8e9b-44d1-b717-1054d490e035","uri":"","name":"*.otc.bitso.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7514699d-61c6-4a0b-a5ca-1752d87b3cc9","sortOrder":13},"sortOrder":13,"tags":null,"recentChangeFlags":null},{"id":"d57b55cd-f17f-406e-afad-4d563ba5230c","uri":"","name":"*.efx.bitso.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e814f570-58ba-49f7-afb0-e84db5d97d6f","sortOrder":14},"sortOrder":14,"tags":null,"recentChangeFlags":null},{"id":"e2016399-1307-4cd8-9980-76a3d4552f0f","uri":"","name":"quetzal.bitso.com\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5f2d7186-c866-4f52-b5e0-ca17e32dc117","sortOrder":15},"sortOrder":15,"tags":null,"recentChangeFlags":null},{"id":"21df882a-e12c-4904-8cc0-3aff7ada94b7","uri":"","name":"login.bitso.io","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"de808322-3673-46a0-a9f7-c6455114a808","sortOrder":16},"sortOrder":16,"tags":null,"recentChangeFlags":null},{"id":"acae922a-f301-4af1-a94e-43af9fe6ab32","uri":"","name":"bitsohelp.zendesk.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"69326f77-260c-4cca-aaf5-5129e2f68d2d","sortOrder":17},"sortOrder":17,"tags":null,"recentChangeFlags":null},{"id":"6d5c9bc6-84be-48c5-9a0b-d29b4980a37e","uri":"","name":"support.bitso.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"45f5c835-a1f9-479b-9378-d999ee07d7cf","sortOrder":18},"sortOrder":18,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"09a71606-59d0-4f36-8a10-ceccdfc2875c","code":"bitso-mbb-og","state":"in_progress","endsAt":null,"bountyId":"a99b5d33-313c-4969-bd01-3612ecf5066b","startsAt":"2025-01-07T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/ce49/1668/78d6da33/7e0b508eecb365dabe2dd93e58906b2b_Avatar-Square-X.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-01-07T18:00:00.044Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/bitso-mbb-og","changelogs":"/engagements/bitso-mbb-og/changelog","submissions":null,"announcements":"/engagements/bitso-mbb-og/announcements","hallOfFame":"/engagements/bitso-mbb-og/hall_of_fames","crowdstream":"/engagements/bitso-mbb-og/crowdstream"},"announcementsCount":3,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/bitso-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=bitso-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/bitso-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/bitso-mbb-og/changelog","publishedAt":"2026-09-08T18:06:58.544Z","engagementChangelogUrl":"/engagements/bitso-mbb-og/changelog/aa9c15b3-c6b6-44a0-818d-e3f748e4aab0","createUserFeedbacksUrl":"/engagements/bitso-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/bitso-mbb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}