{"id":"7235586d-d815-4169-a576-652a8ade16a1","engagementId":"d379e28a-4f05-4b12-b43b-6c35efa136e6","data":{"brief":{"id":"cd5292a2-0f03-4019-b63e-4a14441b971a","name":"Council on Foreign Relations","tagline":"“To afford a continuous conference on international questions affecting the United States...”","description":"\u003ch3\u003eCompany Overview\u003c/h3\u003e\n\n\u003cp\u003eThe Council on Foreign Relations invites you to test their websites \u003ca href=\"https://cfr.org\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://cfr.org\u003c/a\u003e and \u003ca href=\"https://foreignaffairs.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://foreignaffairs.com\u003c/a\u003e! \u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eAbout CFR\u003c/strong\u003e - The Council on Foreign Relations (CFR) is an independent, nonpartisan membership organization, think tank, and publisher dedicated to being a resource for its members, government officials, business executives, journalists, educators and students, civic and religious leaders, and other interested citizens in order to help them better understand the world and the foreign policy choices facing the United States and other countries. Founded in 1921, CFR takes no institutional positions on matters of policy. \u003c/p\u003e\n\n\u003cp\u003eThis program adheres to the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for the prioritization/rating of findings. \u003c/p\u003e","industryTagId":"5e4d9474-e978-41fb-8aa9-d470334dcac5","targetsOverview":"\u003cp\u003eAny domain or property of Council on Foreign Relations not listed in the targets section is out of scope. This includes any and all subdomains not listed above.\u003c/p\u003e\n\n\u003ch3\u003eAbout Targets\u003c/h3\u003e\n\n\u003cp\u003eCenter on Foreign Relations is an organization for international affairs and news. We're hoping researchers will help our team test the website to allow our users to operate in a safe environment. Throughout this test, please keep in mind that there are pages which are operated by 3rd-party providers like Drupal, TCS, etc. and are not included in the scope of the program. Refer to the Out-of-Scope domains (listed above) and the Out-of-Scope section (below). \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eCredentials\u003c/h3\u003e\n\n\u003cp\u003eYou can create an account for yourself at foreignaffairs.com and modeldiplomacy \u003cstrong\u003eonly\u003c/strong\u003e (CFR.org user accounts are Out-of-Scope). You MUST use your @bugcrowdninja.com email address for any accounts related to testing on this program. \u003c/p\u003e\n\n\u003cp\u003eTo create an account, please follow this flow: \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eForeign Affairs - \"Sign-in\" \u0026gt; \"Register\" \u0026gt; register with your BCninja email address\u003c/li\u003e\n\u003cli\u003eModel Diplomacy - Use \"bugcrowd\" as the first name on all account creation (you can make both student and instructor accounts) \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eNOTE: User account functionality on CFR.com is Out-of-Scope.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eOut-of-Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny attempt at DOS / DDOS attacks.\u003c/li\u003e\n\u003cli\u003ePlease limit automated scanners to 2 requests per second or less.\u003c/li\u003e\n\u003cli\u003eAny functionality, pages, or communications hosted by or operated by a 3rd party.\u003c/li\u003e\n\u003cli\u003eAccount functionality located at cfr.org\u003c/li\u003e\n\u003cli\u003eSubdomain takeovers\u003c/li\u003e\n\u003cli\u003eRate limiting submissions \u003c/li\u003e\n\u003cli\u003ehttps://subscribe.foreignaffairs.com \u003c/li\u003e\n\u003cli\u003ehttps://subs.foreignaffairs.com\u003c/li\u003e\n\u003cli\u003eWorld101.cfr.org\u003c/li\u003e\n\u003cli\u003emodeldiplomacy.cfr.org\u003c/li\u003e\n\u003cli\u003eTwitter handles/link hijacks\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":null,"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"cc4ae9c3-5294-478e-a410-a8556891a157","name":"████████","targets":[{"id":"a013b643-48b7-4473-a16e-c07705ea4718","uri":null,"name":"████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"81d9b584-a1c5-496b-b0bb-f40ec0dd4eeb","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"4592d652-bb2d-4ab9-8720-08fe80de0dc4","name":"Backbone","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"53917c1d-52c8-41f3-86f5-166e787ece8f","name":"Select2","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"61c04bbf-9962-45df-8971-a7b55daaf458","name":"MariaDB","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"},{"id":"c3412833-26e7-4bbd-907f-760d9da61232","name":"Newrelic","targetId":"a013b643-48b7-4473-a16e-c07705ea4718"}],"recentChangeFlags":null},{"id":"34ce90dc-bdea-47b6-b01c-31d46ddc79fd","uri":null,"name":"█████████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f0f29e6a-1121-435f-b08b-2031a0a590ec","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"34ce90dc-bdea-47b6-b01c-31d46ddc79fd"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"34ce90dc-bdea-47b6-b01c-31d46ddc79fd"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"34ce90dc-bdea-47b6-b01c-31d46ddc79fd"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"34ce90dc-bdea-47b6-b01c-31d46ddc79fd"},{"id":"c3412833-26e7-4bbd-907f-760d9da61232","name":"Newrelic","targetId":"34ce90dc-bdea-47b6-b01c-31d46ddc79fd"}],"recentChangeFlags":null},{"id":"1174aac7-860d-4b4f-b2e8-b0d84a914380","uri":null,"name":"██████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ee92e42f-59d0-4aab-9e53-39d246f438d0","sortOrder":3},"sortOrder":3,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"1174aac7-860d-4b4f-b2e8-b0d84a914380"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"1174aac7-860d-4b4f-b2e8-b0d84a914380"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"1174aac7-860d-4b4f-b2e8-b0d84a914380"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"1174aac7-860d-4b4f-b2e8-b0d84a914380"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1174aac7-860d-4b4f-b2e8-b0d84a914380"},{"id":"c3412833-26e7-4bbd-907f-760d9da61232","name":"Newrelic","targetId":"1174aac7-860d-4b4f-b2e8-b0d84a914380"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"2cef513f-e794-44c2-9b29-e37952df51af","p1MaxCents":210000,"p1MinCents":150000,"p2MaxCents":100000,"p2MinCents":80000,"p3MaxCents":50000,"p3MinCents":30000,"p4MaxCents":15000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1500,"max":2100},"2":{"min":800,"max":1000},"3":{"min":300,"max":500},"4":{"min":100,"max":150},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"e9bd604f-37c3-4964-9901-215f9fa5eb56","name":"████████████","targets":[{"id":"b6e64f56-95cf-4702-900b-af5a3d2525ee","uri":null,"name":"███████████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8c697f92-139c-4146-93dd-0a199a975495","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b6e64f56-95cf-4702-900b-af5a3d2525ee"}],"recentChangeFlags":null},{"id":"047e8fa3-e3d1-418f-90fa-be72f297e3eb","uri":null,"name":"█████████████████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7ec5ee5f-c8d7-4c67-8c31-7b8f3268327d","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"047e8fa3-e3d1-418f-90fa-be72f297e3eb"}],"recentChangeFlags":null},{"id":"b8698270-6c1b-499b-a939-2d37bc9f564a","uri":null,"name":"█████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c0e773d8-74fb-4d1b-b874-c4ecd8d72e77","sortOrder":2},"sortOrder":2,"tags":[{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"},{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"},{"id":"4592d652-bb2d-4ab9-8720-08fe80de0dc4","name":"Backbone","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"},{"id":"61c04bbf-9962-45df-8971-a7b55daaf458","name":"MariaDB","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"},{"id":"c3412833-26e7-4bbd-907f-760d9da61232","name":"Newrelic","targetId":"b8698270-6c1b-499b-a939-2d37bc9f564a"}],"recentChangeFlags":null},{"id":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d","uri":null,"name":"██████████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7882a883-2388-4f96-90f6-499eb63a21e8","sortOrder":3},"sortOrder":3,"tags":[{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d"},{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d"},{"id":"61c04bbf-9962-45df-8971-a7b55daaf458","name":"MariaDB","targetId":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d"},{"id":"c3412833-26e7-4bbd-907f-760d9da61232","name":"Newrelic","targetId":"12f424c6-c1fc-4b02-9e6e-615a2fd36a6d"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"d379e28a-4f05-4b12-b43b-6c35efa136e6","code":"cfr","state":"in_progress_paused","endsAt":null,"bountyId":"c614102d-2e6a-439f-a908-e9b3ab2cd1d1","startsAt":"2017-09-12T18:30:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Civic, Non-Profit and Membership Groups","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/df75/aa4f/9a3fb531/6c71bed621d07bd078af1cb05746e6ac_Screen_Shot_2017-09-11_at_4.36.11_PM.png","logoBackgroundColor":"#412c26","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":"You should pause all testing activity immediately until further notice.\n\nEffective immediately, we are pausing our engagement until further notice. We apologize for the inconvenience and will let you know as soon as we have more information as to when the program will reopen. In the interim, Bugcrowd and Council of Foreign Relations will be working together to continue triaging and validating all submissions that have come in to date. We appreciate your patience. If you have any questions, please [create a ticket with Bugcrowd Support](https://bugcrowd-support.freshdesk.com/support/tickets/new) to get them answered.","lastTransitionAt":"2026-09-10T14:42:06.271Z","cancellationReason":null,"statusLabel":"In progress paused","routesPaths":{"brief":"/engagements/cfr","changelogs":"/engagements/cfr/changelog","submissions":null,"announcements":"/engagements/cfr/announcements","hallOfFame":"/engagements/cfr/hall_of_fames","crowdstream":"/engagements/cfr/crowdstream"},"announcementsCount":13,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":null,"methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=cfr\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/cfr/engagement_subscribers","engagementChangelogsUrl":"/engagements/cfr/changelog","publishedAt":"2026-09-10T14:42:06.295Z","engagementChangelogUrl":"/engagements/cfr/changelog/7235586d-d815-4169-a576-652a8ade16a1","createUserFeedbacksUrl":"/engagements/cfr/feedbacks","engagementCrowdstreamUrl":"/engagements/cfr/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}