{"id":"85f70ea0-6589-4f95-96f9-aa8bfe7560a8","engagementId":"fe846f98-a038-4279-a6fb-b81874802a46","data":{"brief":{"id":"aefc0df3-b0a1-40ca-9779-595b38d893dd","name":"Consumer Financial Protection Bureau - Vulnerability Disclosure Program","tagline":"We aim to make consumer financial markets work for consumers, responsible providers, and the economy as a whole. We protect consumers from unfair, deceptive, or abusive practices and take action against companies that break the law.","description":"\u003cp\u003eThe Consumer Financial Protection Bureau’s (CFPB) Vulnerability Disclosure Policy facilitates the CFPB’s awareness of otherwise unknown system vulnerabilities. CFPB is committed to authorizing good faith security research, responding to valid vulnerability reports, promoting organizational transparency, and improving security. \u003c/p\u003e\n\n\u003cp\u003eThis Policy describes what systems and types of research are covered by it, how to report vulnerabilities, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.\u003c/p\u003e\n\n\u003cp\u003eThe CFPB was created to provide a single point of accountability for enforcing federal consumer financial laws and protecting consumers in the financial marketplace. Before, that responsibility was divided among several agencies. Today, it’s our primary focus.\u003c/p\u003e\n\n\u003cp\u003eOur work includes:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eRooting out unfair, deceptive, or abusive acts or practices by writing rules, supervising companies, and enforcing the law\u003c/li\u003e\n\u003cli\u003eEnforcing laws that outlaw discrimination in consumer finance\u003c/li\u003e\n\u003cli\u003eTaking consumer complaints\u003c/li\u003e\n\u003cli\u003eEnhancing financial education\u003c/li\u003e\n\u003cli\u003eResearching the consumer experience of using financial products\u003c/li\u003e\n\u003cli\u003eMonitoring financial markets for new risks to consumers\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"2a38890b-c88e-4bc0-8db0-02059f3fafe6","targetsOverview":"\u003cp\u003eAny service not expressly listed above, such as any connected services, are excluded from the scope of the Policy and are not authorized for testing. Additionally, vulnerabilities found in systems from our vendors also fall outside of this Policy’s scope and should be reported directly to the vendor according to their own vulnerability disclosure policies. If you aren’t sure whether a system is in scope or not, or it isn’t but you think it merits testing, please contact us at security@cfpb.gov to discuss. We anticipate increasing the scope of this Policy over time to include additional systems.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eGuidelines\u003c/h2\u003e\n\n\u003cp\u003eCFPB will not recommend or pursue legal action against anyone for security research activities that the CFPB concludes represents a good faith effort to follow this Policy. The CFPB deems such activity to be authorized.\u003c/p\u003e\n\n\u003cp\u003eSecurity researchers may utilize these guidelines below to help clarify the actions they may take and may not take in researching for vulnerabilities. Under this Policy, “security research” means activities in which you:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eNotify us as soon as possible after you discover a real or potential security issue.\u003c/li\u003e\n\u003cli\u003eMake every effort to avoid privacy violations, data or privacy breaches, degradation of user experience, disruption to production systems, and destruction or manipulation of data.\u003c/li\u003e\n\u003cli\u003eOnly use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish command line access and/or persistence, or pivot to other systems.\u003c/li\u003e\n\u003cli\u003eProvide us a reasonable amount of time to resolve the issue before you disclose it publicly (see the Coordinated Disclosure section).\u003c/li\u003e\n\u003cli\u003eDo not submit a high volume of low-quality reports.\u003c/li\u003e\n\u003cli\u003eOnce you’ve established that a vulnerability exists or encounter any sensitive data (e.g., Personally Identifiable Information (PII), financial information, proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else. A failure to adhere to this disclosure rule may result in Legal action.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTest Methods\u003c/h2\u003e\n\n\u003cp\u003eSecurity researchers shall:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eImmediately cease testing and notify us upon discovery of a vulnerability\u003c/li\u003e\n\u003cli\u003eImmediately cease testing and notify us upon discovery of an exposure of nonpublic data\u003c/li\u003e\n\u003cli\u003eImmediately notify us upon discovery of any exposure or disclosure of sensitive data, including PII\u003c/li\u003e\n\u003cli\u003ePurge any stored CFPB nonpublic data upon reporting a vulnerability\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eSecurity researchers may:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eTemporarily view CFPB nonpublic information only to the extent necessary to document the presence of a potential vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eSecurity researchers shall not:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eTest any system other than those identified in the ‘Applicable Systems Scope’ section\u003c/li\u003e\n\u003cli\u003eDisclose vulnerability information except as set forth in the Submitting a Vulnerability Report and Coordinated Disclosure sections\u003c/li\u003e\n\u003cli\u003eEngage in physical testing of facilities or resources (e.g., office access, open doors, tailgating)\u003c/li\u003e\n\u003cli\u003eEngage in social engineering (e.g., “vishing”)\u003c/li\u003e\n\u003cli\u003eSend unsolicited electronic mail to CFPB users (e.g., “phishing” messages)\u003c/li\u003e\n\u003cli\u003eExecute or attempt to execute “Denial of Service” or “Resource Exhaustion” attacks, or other tests that impair access to or damage a system or data\u003c/li\u003e\n\u003cli\u003eIntroduce malicious software\u003c/li\u003e\n\u003cli\u003eUse a CFPB system to launch redirect or amplification attacks against other systems\u003c/li\u003e\n\u003cli\u003eTest in a manner which could degrade the operation of CFPB systems; or intentionally impair, disrupt, or disable CFPB systems\u003c/li\u003e\n\u003cli\u003eTest third-party applications, websites, or services that integrate with, or link to or from, CFPB systems\u003c/li\u003e\n\u003cli\u003eDelete, alter, share, retain, or destroy CFPB data (to include sensitive data and nonpublic information1), or render any CFPB data exposed by the vulnerability inaccessible\u003c/li\u003e\n\u003cli\u003eUse an exploit to exfiltrate data, establish command line access, establish a persistent presence on CFPB systems, or “pivot” to other CFPB systems\u003c/li\u003e\n\u003cli\u003eDisclose any type of sensitive information (technical, financial, operational, regulatory, etc.) or any PII exposed or made accessible by the vulnerability to a third party\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSubmitting Vulnerability Reports\u003c/h2\u003e\n\n\u003cp\u003eIf you are a Security researcher and would like to submit a vulnerability report, please do so by submitting a report with the following information. By providing these details the CFPB can triage and prioritize reports with greater accuracy. Submissions may be reported anonymously. The CFPB prefers that reports be submitted in English, if possible.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe full website URL where the vulnerability was found\u003c/li\u003e\n\u003cli\u003eThe date and time of discovery\u003c/li\u003e\n\u003cli\u003eA detailed description of the vulnerability and potential impact of exploitation\u003c/li\u003e\n\u003cli\u003eTechnical information security analysts can use to replicate the issue (e.g., screenshots offering a detailed description of the steps needed to reproduce the vulnerability)\u003c/li\u003e\n\u003cli\u003eAny proof of concept code (if available)\u003c/li\u003e\n\u003cli\u003eWe request that any scripts or exploit code be embedded into non-executable file types (e.g., .txt)\u003c/li\u003e\n\u003cli\u003eWe can process all common file types and file archives, including zip, 7zip, and gzip\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eOptional: Contact information if you authorize the Bureau to contact you for further technical details to analyze the weakness (Note: this step is optional. If you submit a vulnerability report via email without including contact information, we will assume it is an anonymous submission using a temporary email address. We will not acknowledge receipt or attempt to reply to these submissions.)\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eCoordinated disclosure\u003c/h2\u003e\n\n\u003cp\u003eThe CFPB is committed to the timely correction of reported vulnerabilities. However, we recognize that it may take time to validate and implement corrective actions depending on the nature of your discovery. Therefore, we require that you refrain from sharing information about discovered vulnerabilities for 180 calendar days after your submission. If you believe others should be informed of the vulnerability prior to our implementation of corrective actions, we require that you coordinate in advance with us at security@cfpb.gov. We may share vulnerability reports with the Cybersecurity and Infrastructure Security Agency  (CISA), as well as any affected vendors. We will not share names or contact information for security researchers unless given explicit permission.\u003c/p\u003e\n\n\u003ch2\u003eWhat You Can Expect From Us\u003c/h2\u003e\n\n\u003cp\u003eWhen you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eWithin 3 business days, we will acknowledge that your report has been received.\u003c/li\u003e\n\u003cli\u003eTo the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including on issues or challenges that may delay resolution.\u003c/li\u003e\n\u003cli\u003eWe will maintain an open dialogue to discuss issues.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"2b1a50b9-97e0-4136-934d-c2c14f6966d2","name":"In Scope","targets":[{"id":"ba6a05a9-3f89-416d-9b60-532c89b97b1f","uri":"https://es.consumerfinance.gov/","name":"https://es.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"135b82f3-7711-4211-97db-957da84e1a3e","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ba6a05a9-3f89-416d-9b60-532c89b97b1f"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"ba6a05a9-3f89-416d-9b60-532c89b97b1f"}],"recentChangeFlags":null},{"id":"1e44ab4b-235f-447f-ba82-cd3994dc839f","uri":"https://webservices.cfpb.gov/","name":"https://webservices.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"49ab50cb-0038-4be1-9e46-77f14f77eade","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1e44ab4b-235f-447f-ba82-cd3994dc839f"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"1e44ab4b-235f-447f-ba82-cd3994dc839f"}],"recentChangeFlags":null},{"id":"9d0b9993-801f-4f73-b77a-1a1a295603a5","uri":"https://remote.cfpb.gov/","name":"https://remote.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7f2f7998-b168-45b4-a34f-81660d4dd468","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9d0b9993-801f-4f73-b77a-1a1a295603a5"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"9d0b9993-801f-4f73-b77a-1a1a295603a5"}],"recentChangeFlags":null},{"id":"9654c5f2-1c64-4a06-8e0a-3395f3d7a0e2","uri":"https://api.cfpb.gov/","name":"https://api.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9752331f-a68f-48a7-ab2d-89b2427a1a11","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9654c5f2-1c64-4a06-8e0a-3395f3d7a0e2"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"9654c5f2-1c64-4a06-8e0a-3395f3d7a0e2"}],"recentChangeFlags":null},{"id":"c36f5e54-c929-4b31-80bd-3c46433c8d65","uri":"https://info.consumerfinance.gov/","name":"https://info.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"20d89ef2-f0cb-4082-a9f3-37e5dec67271","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c36f5e54-c929-4b31-80bd-3c46433c8d65"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"c36f5e54-c929-4b31-80bd-3c46433c8d65"}],"recentChangeFlags":null},{"id":"c7f681eb-60da-4768-9bbb-d101e7e3ddea","uri":"https://autodiscover.cfpb.gov/","name":"https://autodiscover.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3537103a-1592-4870-a176-052713af4935","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c7f681eb-60da-4768-9bbb-d101e7e3ddea"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"c7f681eb-60da-4768-9bbb-d101e7e3ddea"}],"recentChangeFlags":null},{"id":"a3622cc2-0d69-4ea6-92a8-79988a6f457a","uri":"https://owa.cfpb.gov/","name":"https://owa.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"41a4e76d-18ef-4254-984a-cfd9dceb4c39","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a3622cc2-0d69-4ea6-92a8-79988a6f457a"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"a3622cc2-0d69-4ea6-92a8-79988a6f457a"}],"recentChangeFlags":null},{"id":"2b94711a-5f5e-496c-9742-14e048f511df","uri":"https://mobile.cfpb.gov/","name":"https://mobile.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6a2b673e-b9c1-4823-a592-daedc8007cff","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2b94711a-5f5e-496c-9742-14e048f511df"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"2b94711a-5f5e-496c-9742-14e048f511df"}],"recentChangeFlags":null},{"id":"ddc993b5-e3f0-4884-9acf-dfeb660a35cc","uri":"https://work.cfpb.gov/","name":"https://work.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b357bdfd-46b7-48e0-9c5b-ac954d82ba41","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ddc993b5-e3f0-4884-9acf-dfeb660a35cc"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"ddc993b5-e3f0-4884-9acf-dfeb660a35cc"}],"recentChangeFlags":null},{"id":"96608c9a-b28d-492f-b718-cab71a618da8","uri":"https://ffiec.cfpb.gov/","name":"https://ffiec.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"605771d8-c581-4713-9510-326c0f6f6f41","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"96608c9a-b28d-492f-b718-cab71a618da8"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"96608c9a-b28d-492f-b718-cab71a618da8"}],"recentChangeFlags":null},{"id":"1a7a3903-033c-419e-a433-d4f7594ab75f","uri":"https://api.consumerfinance.gov/","name":"https://api.consumerfinance.gov/","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3342f9e4-f1b2-4126-8d35-b8422235d9a2","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"1a7a3903-033c-419e-a433-d4f7594ab75f"}],"recentChangeFlags":null},{"id":"3d3815d4-2a47-4603-b352-695ccc842d6d","uri":"https://inclusivity.consumerfinance.gov/","name":"https://inclusivity.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"afb5a324-d087-440f-983f-08474f9228e5","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3d3815d4-2a47-4603-b352-695ccc842d6d"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"3d3815d4-2a47-4603-b352-695ccc842d6d"}],"recentChangeFlags":null},{"id":"0b04bdf4-6771-4901-82ee-544920f8df73","uri":"https://surveys.consumerfinance.gov/","name":"https://surveys.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"61cc6a38-8ff1-42f9-9e1b-37e9f37ffa22","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0b04bdf4-6771-4901-82ee-544920f8df73"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"0b04bdf4-6771-4901-82ee-544920f8df73"}],"recentChangeFlags":null},{"id":"65ed82e9-f303-47e7-9f8b-e3f12fc0897a","uri":"https://story.consumerfinance.gov/","name":"https://story.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"339cd8e5-c113-430e-8e07-1611951ff9cd","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"65ed82e9-f303-47e7-9f8b-e3f12fc0897a"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"65ed82e9-f303-47e7-9f8b-e3f12fc0897a"}],"recentChangeFlags":null},{"id":"455316e4-9164-4684-9063-dc2da8d48644","uri":"https://extranet.cfpb.gov/","name":"https://extranet.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"dcb1c1a6-2585-4430-b949-4ca5f161d6bf","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"455316e4-9164-4684-9063-dc2da8d48644"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"455316e4-9164-4684-9063-dc2da8d48644"}],"recentChangeFlags":null},{"id":"51025077-38e3-440f-be5d-334442d81446","uri":"https://complaint.consumerfinance.gov/","name":"https://complaint.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4c3fc819-ad33-4c2f-82ee-25b3ed25474e","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"51025077-38e3-440f-be5d-334442d81446"}],"recentChangeFlags":null},{"id":"e6901671-d6d7-4515-bcd6-40f9e9641863","uri":"https://files.consumerfinance.gov/","name":"https://files.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1374c6f9-4c56-468a-aa04-32ad5a12fb66","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e6901671-d6d7-4515-bcd6-40f9e9641863"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"e6901671-d6d7-4515-bcd6-40f9e9641863"}],"recentChangeFlags":null},{"id":"6efde9ae-4f1f-43e5-b9cf-1ed7a0abd367","uri":"https://www.mimm.gov/","name":"https://www.mimm.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"909fe739-dbfe-4aa5-89c1-bb7e3badc362","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6efde9ae-4f1f-43e5-b9cf-1ed7a0abd367"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"6efde9ae-4f1f-43e5-b9cf-1ed7a0abd367"}],"recentChangeFlags":null},{"id":"cf64333e-14f6-4e4c-bcc9-766d7ee4d81c","uri":"https://beta.cfpb.gov/","name":"https://beta.cfpb.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0a559bd2-adcb-40fc-b260-7b614cfb3ce2","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cf64333e-14f6-4e4c-bcc9-766d7ee4d81c"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"cf64333e-14f6-4e4c-bcc9-766d7ee4d81c"}],"recentChangeFlags":null},{"id":"73eed84f-7fc6-4bfc-b524-1c2cf4c66aa8","uri":"https://beta.consumerfinance.gov/","name":"https://beta.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fa236ac8-b931-43e7-a84d-aa4efec756f1","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"73eed84f-7fc6-4bfc-b524-1c2cf4c66aa8"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"73eed84f-7fc6-4bfc-b524-1c2cf4c66aa8"}],"recentChangeFlags":null},{"id":"40f35748-5aeb-4f8e-8fc8-8244c0117ff1","uri":"https://search.consumerfinance.gov/","name":"https://search.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b98e9988-0b30-4590-a445-3591f5909b25","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"40f35748-5aeb-4f8e-8fc8-8244c0117ff1"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"40f35748-5aeb-4f8e-8fc8-8244c0117ff1"}],"recentChangeFlags":null},{"id":"1193333e-6ac5-4347-a26d-81486b24b8b4","uri":"http://data.consumerfinance.gov/","name":"http://data.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f0353a21-43f4-4fc3-af51-884066a2e3a0","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1193333e-6ac5-4347-a26d-81486b24b8b4"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"1193333e-6ac5-4347-a26d-81486b24b8b4"}],"recentChangeFlags":null},{"id":"6e4d0d5b-9edf-4381-9fca-38b9417cceed","uri":"https://exam.consumerfinance.gov/","name":"https://exam.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1f8e25bb-432b-4430-8649-a056cfb6ead2","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6e4d0d5b-9edf-4381-9fca-38b9417cceed"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"6e4d0d5b-9edf-4381-9fca-38b9417cceed"}],"recentChangeFlags":null},{"id":"bf577831-29ee-43e3-850a-125f6655c6a8","uri":"https://www.consumerfinancialprotectionbureau.gov/","name":"https://www.consumerfinancialprotectionbureau.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a6357979-25f5-4c42-9fb8-d409d4bc9417","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bf577831-29ee-43e3-850a-125f6655c6a8"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"bf577831-29ee-43e3-850a-125f6655c6a8"}],"recentChangeFlags":null},{"id":"5c0923cb-e319-495c-920f-a8a329d9c237","uri":"https://www.consumerfinance.gov/","name":"https://www.consumerfinance.gov/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b14aa25d-3e0b-4fac-b388-e14e46a91273","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5c0923cb-e319-495c-920f-a8a329d9c237"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"5c0923cb-e319-495c-920f-a8a329d9c237"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"fe846f98-a038-4279-a6fb-b81874802a46","code":"cfpb-vdp","state":"in_progress","endsAt":null,"bountyId":"d58c98b8-2fe4-412c-b89a-76e40d2517f3","startsAt":"2024-12-11T19:14:12Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Government","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/7b99/77ce/36b91249/b1d9b10c795e2c970cda52dcaf572cf1_CFPB_Logo_VDP_Simple.jpg","logoBackgroundColor":"#20aa3f","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-12-11T19:14:12.042Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/cfpb-vdp","changelogs":"/engagements/cfpb-vdp/changelog","submissions":null,"announcements":"/engagements/cfpb-vdp/announcements","hallOfFame":"/engagements/cfpb-vdp/hall_of_fames","crowdstream":"/engagements/cfpb-vdp/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Priority Triage","submitReportUrl":"/engagements/cfpb-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=cfpb-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/cfpb-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/cfpb-vdp/changelog","publishedAt":"2024-12-12T19:46:56.285Z","engagementChangelogUrl":"/engagements/cfpb-vdp/changelog/85f70ea0-6589-4f95-96f9-aa8bfe7560a8","createUserFeedbacksUrl":"/engagements/cfpb-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/cfpb-vdp/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}