{"id":"1ae12edd-3c69-4985-82c5-46fafede3ebc","engagementId":"2cf6c243-65fc-45ab-9d93-1e0eb246489e","data":{"brief":{"id":"94e9604b-a4f7-47b5-8652-6bc0e1468ebc","name":"Bugcrowd","tagline":"Outhack Them All™","description":"\u003cp\u003eBugcrowd orchestrates the creativity of the crowd to solve some of cybersecurity's toughest challenges. Our own security is our highest priority.\u003c/p\u003e\n\n\u003cp\u003eIf you think you’ve found a security vulnerability in our systems, we invite you to report it to us via our platform. We commit to working with you to get it assessed and handled appropriately, and offer cash rewards for valid, unique vulnerability reports.\u003c/p\u003e\n\n\u003cp\u003eThis program is for reporting potential security vulnerabilities only. If you want to report a functional bug, require assistance with a submission, or have a general question, please visit our \u003ca href=\"https://www.bugcrowd.com/about/contact/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003econtact page\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eWe’ve set up a bounty on the Bugcrowd platform called \u003ca href=\"https://bugcrowd.com/hackme\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHack Me!\u003c/a\u003e, where you’re welcome to hack as if on a customer’s bounty. Please do not ever test against a real customer’s bounty. As stated in our \u003ca href=\"https://www.bugcrowd.com/resource/code-of-conduct/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecode of conduct\u003c/a\u003e, disruptive testing which affects other Researchers’ access to the testing environment, or adversely impacts a customer’s systems and/or accounts is prohibited. \u003c/p\u003e\n\n\u003cp\u003eOur bounty program adheres strictly to Bugcrowd’s \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eVulnerability Rating Taxonomy\u003c/a\u003e – a collaborative, community-driven effort to classify common security vulnerabilities and identify baseline severity ratings based on real findings across hundreds of bug bounty programs. Before submitting your vulnerability, consult the VRT to determine its severity and whether it may be eligible for a reward. Vulnerabilities with a P5 baseline rating according to the VRT are generally not eligible for a bounty. If you’d like to make a suggestion to improve the VRT, you can create an issue on \u003ca href=\"https://github.com/bugcrowd/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGitHub\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch3\u003eBonuses\u003c/h3\u003e\n\n\u003cp\u003eWhen presented with \u003cstrong\u003eespecially interesting High (P2) or Critical (P1) Priority vulnerabilities\u003c/strong\u003e – especially if our internal knowledge allows us to identify a much greater impact than what an outside researcher's proof-of-concept may have suggested on its own – we may choose to award \u003cstrong\u003ean additional bonus amount of up to 100% of the initial reward\u003c/strong\u003e suggested by our priority guidelines. Such bonuses are always at our discretion.       \u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003e\u003cstrong\u003eWe are most interested in vulnerabilities on our core platform and infrastructure, which run on Amazon Web Services.\u003c/strong\u003e However, if you identify a host not listed in the Targets section that you can reasonably demonstrate belongs to Bugcrowd, feel free to submit a report asking about its eligibility. \u003cstrong\u003eSuch reports will not result in a penalty, even if it turns out that the given target is ineligible.\u003c/strong\u003e If deemed eligible, reports against such targets will be assessed on a case-by-case basis.\u003c/p\u003e\n\n\u003cp\u003eAuthenticated testing is limited to whatever credentials you can self provision - no supplemental credentials or access will be provided for testing.\u003c/p\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cp\u003eVulnerability reports lacking manual validation, such as those solely reliant on automated tools and scanners, or those that describe theoretical attack vectors without substantiated proof of exploitability, will be classified as \"Not Applicable\". \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eRate Limiting\u003c/li\u003e\n\u003cli\u003eEXIF data not stripped from file attachments on Submissions \u003c/li\u003e\n\u003cli\u003egithub.com/bugcrowd.com PRs, Issues\n\n\u003cul\u003e\n\u003cli\u003eunless the finding revolves around credential leakage or critical impact\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003ePrompt Injection vulnerabilities\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cp\u003eSubmissions outlining the ability for a researcher to set their username to match the format used by Bugcrowd Staff, Customers and ASE team are Out of Scope. The username alone has no effect in user permissions on our platform.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eadding any variation of *_bugcrowd to the username for normal users\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eNon-Rewardable Targets\u003c/h2\u003e\n\n\u003cp\u003eOur approach to rewarding vulnerabilities is based on implementing code changes. In the case of a 3rd party system where the code change falls outside our reach to fix if the vulnerability will not be up for a cash prize. \u003c/p\u003e\n\n\u003cp\u003eSpecific areas include:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e3rd party services listed below\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eWe reserve the right to, provide rewards for exceptionally impactful and informative submissions, even if they are targeting assets that are not typically eligible for rewards. However, the highest payouts will be reserved for the explicitly listed in-scope targets.\u003c/p\u003e\n\n\u003ch2\u003eThird-party services\u003c/h2\u003e\n\n\u003cp\u003eBugcrowd uses a number of third-party providers and services. We cannot authorize security testing against systems that do not belong to us, but strongly suggest reporting issues identified within these services to the third-party directly:\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eOut-of-scope target   \u003c/th\u003e\n\u003cth\u003e Company\u003c/th\u003e\n\u003cth\u003eReport via\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003ewww.bugcrowd.com, blog.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://pantheon.io\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ePantheon\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://bugcrowd.com/pantheon\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ePantheon Bug Bounty\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.cloudflare.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCloudflare\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://hackerone.com/cloudflare\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCloudflare Bug Bounty\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.drift.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eDrift\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"mailto:infosec@drift.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eEmail\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.intercom.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eIntercom\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://bugcrowd.com/intercom\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eIntercom Bug Bounty\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eforum.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.discourse.org\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eDiscourse\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://hackerone.com/discourse\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eDiscourse Bug Bounty\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eemail.bugcrowd.com, email.forum.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.mailgun.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eMailgun\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.mailgun.com/contact\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eContact\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ecollateral.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.outreach.io\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOutreach\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.outreach.io/trust/responsible-disclosure\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOutreach Bug Bounty\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ebounce.bugcrowd.com,  go.bugcrowd.com,  ww2.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.marketo.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eMarketo\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"mailto:support@marketo.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eEmail\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003epages.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.hubspot.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHubspot\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://bugcrowd.com/hubspot\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHubspot Bug Bounty\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eresearcherdocs.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://readme.io\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eReadme.io\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"mailto:support@readme.io\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eEmail\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eevents.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://splashthat.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSplash\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"mailto:privacy@splashthat.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eEmail\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eassetinventory.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://bugcrowd.com/bitdiscovery\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBitDiscovery\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://bugcrowd.com/bitdiscovery\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBitDiscovery\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ebugcrowd*.freshdesk.com\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://freshdesk.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFreshdesk\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"mailto:support@freshdesk.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFreshdesk\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ebugcrowd-support.freshdesk.com \u003cstrong\u003esupport widget\u003c/strong\u003e\n\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://freshdesk.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFreshdesk\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"mailto:support@freshdesk.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFreshdesk\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003egithub.com/bugcrowd \u003cstrong\u003ePRs, Issues etc\u003c/strong\u003e\n\u003c/td\u003e\n\u003ctd\u003e--\u003c/td\u003e\n\u003ctd\u003eunless the finding revolves around credential leakage or critical impact\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003etrust.bugcrowd.com\u003c/td\u003e\n\u003ctd\u003eSafebase\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eAll Jumio related endpoints\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://www.jumio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eJumio (NetVerify)\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://vdp.jumio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eJumio VDP\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eHowever, if you believe an issue with one of our third-party service providers is the result of Bugcrowd's misconfiguration or insecure usage of that service, we'd appreciate your report regarding the issue.\u003c/p\u003e\n\n\u003ch2\u003ePast and Present Employees\u003c/h2\u003e\n\n\u003cp\u003eBugcrowd Employees can participate in our own internal program, but are subject to our Employee Participation policies. These policies can be found on our internal wiki - if in doubt contact our internal program administrators.\u003c/p\u003e\n\n\u003cp\u003eThanks and props to our past employees who are out bounty-hunting! There is a 30-day exclusion cooldown on your participation in this program. We will not accept submissions from you until 30 days after you've left the company, to minimise conflicts of interest.\u003c/p\u003e\n\n\u003ch1\u003eSafe Harbor\u003c/h1\u003e\n\n\u003cp\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; \u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; \u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy;\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003c/p\u003e\n\n\u003cp\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our official channels before going any further.\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":"\u003cp\u003eThis program requires explicit permission to disclose the results of a submission.\u003c/p\u003e"},"scope":[{"id":"5b06ac58-5c77-4c58-9456-68d205404f43","name":"In Scope Targets ","targets":[{"id":"4cd63f5a-895d-4aab-97d3-6a5aec5c3e73","uri":"https://docs.bugcrowd.com/","name":"docs.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"38042aa6-a3e2-4a4a-8c3f-e1cc789af984","sortOrder":0},"sortOrder":0,"tags":[{"id":"40ac7f57-395c-4f6a-82fb-292f80ab0240","name":"HTML","targetId":"4cd63f5a-895d-4aab-97d3-6a5aec5c3e73"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4cd63f5a-895d-4aab-97d3-6a5aec5c3e73"}],"recentChangeFlags":null},{"id":"1f7a04b5-75e2-475f-910b-1e854ea84e09","uri":"https://bugcrowd.com/programs","name":"bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"31f66840-bc3b-4934-a60f-30d3dba15286","sortOrder":0},"sortOrder":0,"tags":[{"id":"30a3c3f4-5f27-4be7-9e4f-5fe8e80828f8","name":"Elasticsearch","targetId":"1f7a04b5-75e2-475f-910b-1e854ea84e09"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"1f7a04b5-75e2-475f-910b-1e854ea84e09"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"1f7a04b5-75e2-475f-910b-1e854ea84e09"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"1f7a04b5-75e2-475f-910b-1e854ea84e09"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1f7a04b5-75e2-475f-910b-1e854ea84e09"}],"recentChangeFlags":null},{"id":"d73c1af1-76bf-4846-bec0-e051702ae540","uri":"https://tracker.bugcrowd.com","name":"Crowdcontrol","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2460973a-1c37-4f99-a12a-9c8fed58bc75","sortOrder":0},"sortOrder":0,"tags":[{"id":"30a3c3f4-5f27-4be7-9e4f-5fe8e80828f8","name":"Elasticsearch","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"}],"recentChangeFlags":null},{"id":"04c05140-1870-43b1-85b4-1e732d176499","uri":"https://api.bugcrowd.com","name":"api.bugcrowd.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4546514a-c078-4f4c-be87-cbd6c008cb69","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"30a3c3f4-5f27-4be7-9e4f-5fe8e80828f8","name":"Elasticsearch","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"6a9fe373-cb50-48a4-8f00-f390acde8447","name":"JSON","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"04c05140-1870-43b1-85b4-1e732d176499"}],"recentChangeFlags":null},{"id":"e77719e3-3e62-4e4d-963b-8bd3b36e86b4","uri":"https://gov.bugcrowd.net","name":"gov.bugcrowd.net","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"af28fb39-1938-4ac7-b2f6-a0482c5c0688","sortOrder":4},"sortOrder":4,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"e77719e3-3e62-4e4d-963b-8bd3b36e86b4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e77719e3-3e62-4e4d-963b-8bd3b36e86b4"}],"recentChangeFlags":null},{"id":"4b77bf41-efbb-42bd-a24b-4198deb3bc22","uri":"https://*.gov.bugcrowd.net","name":"*.gov.bugcrowd.net","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"668bafd4-a45c-4aa5-80af-2b6b6e54d3e4","sortOrder":5},"sortOrder":5,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"4b77bf41-efbb-42bd-a24b-4198deb3bc22"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4b77bf41-efbb-42bd-a24b-4198deb3bc22"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"f4ab253b-844f-4f9b-acd9-7d1a73587677","p1MaxCents":1000000,"p1MinCents":250100,"p2MaxCents":250000,"p2MinCents":90100,"p3MaxCents":90000,"p3MinCents":30100,"p4MaxCents":30000,"p4MinCents":30000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eDisclaimer: Government (.gov) targets may not be publicly accessible at this time.\u003c/p\u003e","rewardRangeData":{"1":{"min":2501,"max":10000},"2":{"min":901,"max":2500},"3":{"min":301,"max":900},"4":{"min":300,"max":300},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"e4d0b3ac-c094-469e-a6f6-fa57892c0499","name":"Beta Feature Target","targets":[{"id":"a916c675-7b86-451d-8f79-ec11c25c1f7c","uri":"https://identity.bugcrowd.com/","name":"https://identity.bugcrowd.com/ ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"01fac464-0c62-44a5-a4c7-0a6025192b44","sortOrder":0},"sortOrder":0,"tags":[{"id":"16818e15-ac0f-4e76-999b-8b6a87db2837","name":"Docker","targetId":"a916c675-7b86-451d-8f79-ec11c25c1f7c"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"a916c675-7b86-451d-8f79-ec11c25c1f7c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a916c675-7b86-451d-8f79-ec11c25c1f7c"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"a916c675-7b86-451d-8f79-ec11c25c1f7c"}],"recentChangeFlags":null},{"id":"82581bfe-f689-4e05-86bf-2d7c27801ee0","uri":"","name":"*.bugcrowd.com/auth/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"672efd21-3239-4a55-999f-2278478b914a","sortOrder":0},"sortOrder":0,"tags":[{"id":"16818e15-ac0f-4e76-999b-8b6a87db2837","name":"Docker","targetId":"82581bfe-f689-4e05-86bf-2d7c27801ee0"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"82581bfe-f689-4e05-86bf-2d7c27801ee0"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"82581bfe-f689-4e05-86bf-2d7c27801ee0"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"82581bfe-f689-4e05-86bf-2d7c27801ee0"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"e249aa36-c4de-4d96-b96c-b5e827855b94","p1MaxCents":500000,"p1MinCents":150000,"p2MaxCents":150000,"p2MinCents":50000,"p3MaxCents":50000,"p3MinCents":10000,"p4MaxCents":10000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eOur engineering team is working on migrating the platform to use centralized authentication and we appreciate the help of our researchers to test this beta feature! Please note not everyone may have access to the endpoint. In addition reports  are subject to be duped to internal ones. \u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eThis feature is subject to different rewards than our main program\u003c/strong\u003e\u003c/p\u003e","rewardRangeData":{"1":{"min":1500,"max":5000},"2":{"min":500,"max":1500},"3":{"min":100,"max":500},"4":{"min":100,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"eed2bc96-b290-4d7e-b1cb-93abb4bd907f","name":"Out of scope targets","targets":[{"id":"ace5f343-9bfb-41d2-8855-094c923c0da7","uri":null,"name":"bugcrowd*.freshdesk.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"488f83a0-c644-44d8-b3e4-278319e7e1ae","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ace5f343-9bfb-41d2-8855-094c923c0da7"}],"recentChangeFlags":null},{"id":"0e68901f-3634-4a28-8e9e-ddd1ee5f3979","uri":"https://www.bugcrowd.com","name":"www.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2b7ce6ed-4ca9-4759-84be-7d5b53d0f417","sortOrder":0},"sortOrder":0,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"0e68901f-3634-4a28-8e9e-ddd1ee5f3979"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0e68901f-3634-4a28-8e9e-ddd1ee5f3979"}],"recentChangeFlags":null},{"id":"2e28dd94-19f8-4054-b438-e7f6de50c342","uri":null,"name":"blog.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"93494ebc-ed94-4cb9-9b68-55ac454cbd2f","sortOrder":0},"sortOrder":0,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"2e28dd94-19f8-4054-b438-e7f6de50c342"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2e28dd94-19f8-4054-b438-e7f6de50c342"}],"recentChangeFlags":null},{"id":"63e83eb8-a032-4fcf-8ee6-726f8d2c1fd1","uri":null,"name":"researcherdocs.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"19fd75a2-ec9a-4f1e-ae2d-0a3085363d9b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"63e83eb8-a032-4fcf-8ee6-726f8d2c1fd1"}],"recentChangeFlags":null},{"id":"842e0522-e802-46dc-b709-f552f0cd0e38","uri":null,"name":"pages.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"09fa2554-b44e-4e04-a140-e12ecef40109","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"842e0522-e802-46dc-b709-f552f0cd0e38"}],"recentChangeFlags":null},{"id":"87eecf78-edf4-46c7-8a10-2a61c2499759","uri":null,"name":"forum.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4da2edad-c6d8-45c6-b7f7-0ca64d4abcec","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"87eecf78-edf4-46c7-8a10-2a61c2499759"}],"recentChangeFlags":null},{"id":"d5a318fd-0775-4826-8db8-5e78822d4a6b","uri":null,"name":"email.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7daf636d-4d4b-4507-b681-dd0f6df366bd","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d5a318fd-0775-4826-8db8-5e78822d4a6b"}],"recentChangeFlags":null},{"id":"f85d4fca-4fa1-4ced-bd9c-741c11254b2c","uri":null,"name":"email.forum.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ca654893-b3bf-41e7-83d1-98eaa615a634","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f85d4fca-4fa1-4ced-bd9c-741c11254b2c"}],"recentChangeFlags":null},{"id":"29342e13-69ea-4052-a7e4-958e42c38fc8","uri":"https://go.bugcrowd.com","name":"go.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"52f11c87-321b-4652-9a54-bddf5739752c","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"29342e13-69ea-4052-a7e4-958e42c38fc8"}],"recentChangeFlags":null},{"id":"11fe0654-a401-4bbd-9d5e-ad0611df8721","uri":null,"name":"events.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2d5db606-7967-4ce5-af0c-616f0410a878","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"11fe0654-a401-4bbd-9d5e-ad0611df8721"}],"recentChangeFlags":null},{"id":"df2ce879-43e0-4f47-a704-dd3ad3742096","uri":"https://assetinventory.bugcrowd.com","name":"assetinventory.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"abcc360c-0dda-4647-aa80-fc420980180f","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"df2ce879-43e0-4f47-a704-dd3ad3742096"}],"recentChangeFlags":null},{"id":"b007ceaa-3030-470f-8291-49418c3a8f06","uri":"https://community.bugcrowd.com","name":"community.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"83397a24-1a8b-4d1c-bf55-b08170530687","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b007ceaa-3030-470f-8291-49418c3a8f06"}],"recentChangeFlags":null},{"id":"c0a36c54-7ddc-47ff-a441-f9229f5def23","uri":"","name":"trust.bugcrowd.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b4db9b4a-60b3-47f3-aae6-a7a1d23c40ef","sortOrder":12},"sortOrder":12,"tags":null,"recentChangeFlags":null},{"id":"d90e0b63-ae5c-445e-bf39-9abf5cf75585","uri":"","name":"Social Engineering","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e51b9340-8ceb-40a0-a0df-1cd21861e42e","sortOrder":13},"sortOrder":13,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eOther domains/assets owned by Bugcrowd but not listed, are not in scope and are ineligible for bounty\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[{"id":"dd9da3d1-8539-4d2f-8f57-98081d89f3eb","attachmentPath":"https://bugcrowd.com/engagements/bugcrowd/attachments/dd9da3d1-8539-4d2f-8f57-98081d89f3eb","name":"flag.txt","filename":"flag.txt","description":null,"icon":"fileOther","size":39,"sizeLabel":"39 Bytes","uploadedAt":"10 Jul 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/bugcrowd/attachments/dd9da3d1-8539-4d2f-8f57-98081d89f3eb"}],"engagement":{"id":"2cf6c243-65fc-45ab-9d93-1e0eb246489e","code":"bugcrowd","state":"in_progress","endsAt":null,"bountyId":"5f1f8cff-7cec-4d88-8a50-879531a8c80c","startsAt":"2013-09-07T01:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/ef74/d1fa/62a5b64c/3809e0af42850a579f02c3434743e3ca_bugcrowd__1_.png","logoBackgroundColor":"#1a1a1a","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2013-09-07T01:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/bugcrowd","changelogs":"/engagements/bugcrowd/changelog","submissions":null,"announcements":"/engagements/bugcrowd/announcements","hallOfFame":"/engagements/bugcrowd/hall_of_fames","crowdstream":"/engagements/bugcrowd/crowdstream"},"announcementsCount":2,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/bugcrowd/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=bugcrowd\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/bugcrowd/engagement_subscribers","engagementChangelogsUrl":"/engagements/bugcrowd/changelog","publishedAt":"2026-05-27T08:26:41.022Z","engagementChangelogUrl":"/engagements/bugcrowd/changelog/1ae12edd-3c69-4985-82c5-46fafede3ebc","createUserFeedbacksUrl":"/engagements/bugcrowd/feedbacks","engagementCrowdstreamUrl":"/engagements/bugcrowd/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}