{"id":"0adbe3f5-58a6-49ca-825c-402d3d836e5b","engagementId":"d1e4c007-7d65-4620-9006-0eb6d69164b8","data":{"brief":{"id":"5dc4b7c0-57ee-457c-8916-78b979a07b12","name":"BNZ Responsible Disclosure Program","tagline":"Responsible Disclosure Program","description":"\u003cp\u003eThank you for participating in BNZ’s Responsible Disclosure Program.  The responsible disclosure of security vulnerabilities helps us ensure the security and privacy of BNZ and our customers. \u003c/p\u003e\n\n\u003cp\u003eTo make a disclosure you'll need to first \u003ca href=\"https://bugcrowd.com/user/sign_up\" title=\"Bugcrowd sign up\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esign up with Bugcrowd\u003c/a\u003e or login to your existing account.\u003c/p\u003e\n\n\u003cp\u003ePlease be aware BNZ will not correspond with you directly, disclose remediation steps or timeframes. \u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eRatings\u003c/strong\u003e\u003cbr\u003e\nThis program adheres to the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for the prioritization/rating of findings.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eNote: No monetary disbursements for findings will be provided. Use of the Bugcrowd program is subject to the BugCrowd Terms and Conditions\u003c/em\u003e \u003c/p\u003e","industryTagId":"b3d6ff0b-119e-4f5b-9c38-ee13f125fc52","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of the Bank of New Zealand not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to the Bank of New Zealand, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eNote: the initial scope has been limited to BNZ's main page, but keep an eye out as the program matures, the scope will expand.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eCredentials are not provided for testing on this program. Please do not test with personal accounts or logins.\u003c/p\u003e\n\n\u003ch2\u003eFocus areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eOWASP top 10\u003c/li\u003e\n\u003cli\u003ePII and customer data\u003c/li\u003e\n\u003cli\u003eBroken Access Control \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDuring testing please do not submit applications and contact forms that would apply for accounts, products or otherwise engage with BNZ staff. \u003c/li\u003e\n\u003cli\u003eBNZ customer data, accounts or any interaction with BNZ's customers.\u003c/li\u003e\n\u003cli\u003eBNZ 3rd party systems and integrations. \u003c/li\u003e\n\u003cli\u003eTesting with a personal user account or creating a Bank account for testing. \u003c/li\u003e\n\u003cli\u003eAny contact or engagement with BNZ staff their or their suppliers.\u003c/li\u003e\n\u003cli\u003eAll BNZ bank physical locations.\u003c/li\u003e\n\u003cli\u003eCredential Stuffing/Password Spraying attacks\u003c/li\u003e\n\u003cli\u003eStored XSS that might affect any account not owned by you\u003c/li\u003e\n\u003cli\u003eDOS/DDOS\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e for clarification before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"20c8fa87-04d4-4be2-b352-f0b3b58fb0d2","name":"In Scope","targets":[{"id":"800d109d-cbe8-4752-8339-9cf55c8917b8","uri":"https://www.bnz.co.nz","name":"www.bnz.co.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7a22ffde-eb6f-4e67-8a7d-0db8d7581073","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"800d109d-cbe8-4752-8339-9cf55c8917b8"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"800d109d-cbe8-4752-8339-9cf55c8917b8"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"800d109d-cbe8-4752-8339-9cf55c8917b8"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"800d109d-cbe8-4752-8339-9cf55c8917b8"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"d1e4c007-7d65-4620-9006-0eb6d69164b8","code":"bnz","state":"in_progress","endsAt":null,"bountyId":"7540409e-d706-4893-84eb-7194010a38ca","startsAt":"2020-10-08T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Banking","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/c1b3/51c3/f3013291/e879acd562e10a9e64570df2cf10a7c7_0__13_.jpeg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-10-08T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/bnz","changelogs":"/engagements/bnz/changelog","submissions":null,"announcements":"/engagements/bnz/announcements","hallOfFame":"/engagements/bnz/hall_of_fames","crowdstream":"/engagements/bnz/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/bnz/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=bnz\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/bnz/engagement_subscribers","engagementChangelogsUrl":"/engagements/bnz/changelog","publishedAt":"2024-07-27T02:05:27.707Z","engagementChangelogUrl":"/engagements/bnz/changelog/0adbe3f5-58a6-49ca-825c-402d3d836e5b","createUserFeedbacksUrl":"/engagements/bnz/feedbacks","engagementCrowdstreamUrl":"/engagements/bnz/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}