{"id":"53291dfd-8e6f-47b3-8fb6-9ac48fd1b8f1","engagementId":"46e53707-788d-4f26-bdb5-26169beaa883","data":{"brief":{"id":"a7d29b67-4d62-483b-b16b-088738b35479","name":"Chemist Warehouse Vulnerability Disclosure Engagement","tagline":"Chemist Warehouse, part of the My Chemist Retail Group, is one of Australia’s largest pharmacy retailers, with over 500 stores across Australia and internationally.","description":"\u003cp\u003eWelcome to the Chemist Warehouse Vulnerability Disclosure Program!\u003cbr\u003e\nWe are proud to be one of Australia’s leading and fastest-growing retail pharmacy groups, with an expanding international footprint. \u003c/p\u003e\n\n\u003cp\u003eAs part of our dedication to protecting our customers and their data, we take security seriously. This Vulnerability Disclosure Program reflects our commitment to working with the security research community to identify and resolve potential vulnerabilities in a responsible, transparent, and collaborative manner.\u003c/p\u003e\n\n\u003cp\u003eGood luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization and rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Chemist Warehouse not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Chemist Warehouse, you can report it to our here.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eTarget Information\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease ensure your report demonstrates clearly reproduction steps, impact on Chemist Warehouse, and suggested remediation steps specific to the vulnerability report.\u003c/li\u003e\n\u003cli\u003eSubmit one vulnerability per report unless chaining is necessary for impact.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eCredentials\u003c/h2\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. You may register for accounts \u003ca href=\"https://www.chemistwarehouse.com.au/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch2\u003eAccess/Traffic Identification\u003c/h2\u003e\n\n\u003cp\u003ePlease use the HTTP Header \u003ccode\u003eX-Correlation-Id: bugcrowd-handle\u003c/code\u003e for all requests.\u003c/p\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eP5 vulnerabilities\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvailability/volumetric testing e.g.:\n\n\u003cul\u003e\n\u003cli\u003eDoS/DDoS/Network DoS\u003c/li\u003e\n\u003cli\u003eRate limiting bypass attempts\u003c/li\u003e\n\u003cli\u003eEmail bombing flooding\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eRate limiting issues on non-authenticated endpoints\u003c/li\u003e\n\u003cli\u003eSubdomain takeovers without business impact\u003c/li\u003e\n\u003cli\u003eKnown CVEs without an active exploit or PoC\u003c/li\u003e\n\u003cli\u003eCSRF without sensitive action\u003c/li\u003e\n\u003cli\u003eClickjacking without sensitive impact\u003c/li\u003e\n\u003cli\u003eSelf-XSS or issues requiring full user interaction\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAutomated scanning without prior written approval\u003c/li\u003e\n\u003cli\u003eInteracting or manipulate other stakeholders and their associated accounts including:\n\n\u003cul\u003e\n\u003cli\u003eSocial engineering attacks\u003c/li\u003e\n\u003cli\u003ePhishing attacks\u003c/li\u003e\n\u003cli\u003ePhysical attacks\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003ePoCs requiring user devices to be compromised or outdated\u003c/li\u003e\n\u003cli\u003eThird party providers and services\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePotential post-exploitation scenarios\u003c/strong\u003e: If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding. We will work with you to evaluate the vulnerability and award you accordingly for the final impact and severity. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eStolen/Breached Credentials\u003c/h2\u003e\n\n\u003cp\u003eIf you happen to identify vulnerabilities involving data that has been exposed or leaked such as dark web forums or leaked credential sites, you can report it to this engagement. However, be aware that it is only eligible for points-based compensation. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance.\u003c/p\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eAuthorized\u003c/strong\u003e under the \u003ca href=\"https://www.law.cornell.edu/uscode/text/18/1030\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eComputer Fraud and Abuse Act (CFAA)\u003c/a\u003e and/or similar applicable state or international laws. Chemist Warehouse will not pursue or support legal action against you for accidental, good-faith violations of this policy.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eExempt\u003c/strong\u003e from the \u003ca href=\"https://www.copyright.gov/legislation/dmca.pdf\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eDigital Millennium Copyright Act (DMCA)\u003c/a\u003e. We will not bring a claim against you for bypassing technical controls in the course of good-faith security testing.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eExempt\u003c/strong\u003e from limitations or restrictions in our Terms \u0026amp; Conditions that would otherwise interfere with legitimate security research. These restrictions are waived on a limited basis, specifically for work covered under this policy.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eLawful, responsible, and beneficial\u003c/strong\u003e to the security of Chemist Warehouse, its customers, and the broader Internet community—provided it is conducted in good faith.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eProtected\u003c/strong\u003e against any adverse action for testing within scope, reporting responsibly, and adhering to this program’s rules.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eImportant:\u003c/strong\u003e You are expected to comply with all applicable local, state, federal, and international laws. If you are unsure whether your conduct falls within this policy, please seek guidance via Bugcrowd Support \u003cstrong\u003ebefore\u003c/strong\u003e proceeding.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"17c8e9b2-afc8-4c3b-b9de-c445f193848f","name":"In Scope","targets":[{"id":"fd949120-c777-43a2-9bbb-aba436adb400","uri":"https://chemistwarehouse.com.au","name":"www.chemistwarehouse.com.au/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"442cf44d-b2a4-44a9-b14d-c146b511d339","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"fd949120-c777-43a2-9bbb-aba436adb400"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"fd949120-c777-43a2-9bbb-aba436adb400"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"fd949120-c777-43a2-9bbb-aba436adb400"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"fd949120-c777-43a2-9bbb-aba436adb400"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fd949120-c777-43a2-9bbb-aba436adb400"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"fd949120-c777-43a2-9bbb-aba436adb400"}],"recentChangeFlags":null},{"id":"b8ae7f95-418d-468b-bd64-b4f04397a0d9","uri":"https://api.chemistwarehouse.com.au","name":"api.chemistwarehouse.com.au","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ac1938ba-919f-4f99-9c54-ba5a8a05bb9f","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"b8ae7f95-418d-468b-bd64-b4f04397a0d9"}],"recentChangeFlags":null},{"id":"58652b70-403a-4a4a-9fb5-baf1d0c5c9b8","uri":"https://play.google.com/store/apps/details?id=au.com.cwretailservices.cwapp\u0026hl=en_AU","name":"Chemist Warehouse Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5fd0d0b8-3483-4428-b424-901e7612042a","sortOrder":2},"sortOrder":2,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"58652b70-403a-4a4a-9fb5-baf1d0c5c9b8"}],"recentChangeFlags":null},{"id":"e64f0c5d-59e7-405e-a48f-fb568c621830","uri":"https://apps.apple.com/au/app/the-chemist-warehouse-app/id1072026483","name":"Chemist Warehouse iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1c358a31-692b-4d96-bafe-4ed94d0631d5","sortOrder":3},"sortOrder":3,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"e64f0c5d-59e7-405e-a48f-fb568c621830"}],"recentChangeFlags":null},{"id":"8405164f-6bdc-4367-8116-7b5ec7ef68eb","uri":"https://www.epharmacy.com.au","name":"www.epharmacy.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"705a107d-ee62-46d9-b8d3-cd811ced48bc","sortOrder":4},"sortOrder":4,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"8405164f-6bdc-4367-8116-7b5ec7ef68eb"}],"recentChangeFlags":null},{"id":"140a3c27-a4c2-4b4c-8dab-cbd3ef0e0b4d","uri":"https://ecentral.sigmahealthcare.com.au","name":"ecentral.sigmahealthcare.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1311e0a4-a034-4fad-bc05-eed6a1f33c7e","sortOrder":5},"sortOrder":5,"tags":[{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"140a3c27-a4c2-4b4c-8dab-cbd3ef0e0b4d"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"140a3c27-a4c2-4b4c-8dab-cbd3ef0e0b4d"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"140a3c27-a4c2-4b4c-8dab-cbd3ef0e0b4d"}],"recentChangeFlags":null},{"id":"7af1bc60-b118-4121-a476-efe61eead613","uri":"https://gpreach.net.au","name":"gpreach.net.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0e0f4a78-e667-49e5-881f-86927f6b6b0f","sortOrder":11},"sortOrder":11,"tags":[{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"7af1bc60-b118-4121-a476-efe61eead613"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"7af1bc60-b118-4121-a476-efe61eead613"}],"recentChangeFlags":null},{"id":"6ff51041-8468-4ed5-96e2-6118958aef32","uri":"https://*.newsamplesplus.com.au","name":"newsamplesplus.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b9649679-79aa-4f34-9242-ce58d845d61d","sortOrder":14},"sortOrder":14,"tags":[{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"6ff51041-8468-4ed5-96e2-6118958aef32"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"6ff51041-8468-4ed5-96e2-6118958aef32"}],"recentChangeFlags":null},{"id":"919b26c3-12c8-4eb5-beff-5b77701b6ce5","uri":"https://samplesplus.com.au","name":"samplesplus.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"329603d5-83ab-4081-82ea-7e5395e3ea5f","sortOrder":15},"sortOrder":15,"tags":[{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"919b26c3-12c8-4eb5-beff-5b77701b6ce5"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"919b26c3-12c8-4eb5-beff-5b77701b6ce5"}],"recentChangeFlags":null},{"id":"f9e9c4a8-38a2-4bd6-acd5-8a9cc7c78a0f","uri":"https://proxi-mate.com.au","name":"proxi-mate.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cdae85a2-75e2-4b77-9aad-145bf6ebfb48","sortOrder":15},"sortOrder":15,"tags":null,"recentChangeFlags":null},{"id":"8f904171-6a08-4652-9be3-f2cf71e3076f","uri":"https://proximate.net.au","name":"proximate.net.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"963de874-cee2-4f18-97c1-758694914d8e","sortOrder":16},"sortOrder":16,"tags":null,"recentChangeFlags":null},{"id":"544096dc-c098-4d0e-8523-d3c8fdc93e01","uri":"https://adf.sigmahealthcare.com.au","name":"adf.sigmahealthcare.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bd16890f-8374-4124-8e2f-5d5e34a82b6c","sortOrder":18},"sortOrder":18,"tags":[{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"544096dc-c098-4d0e-8523-d3c8fdc93e01"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"544096dc-c098-4d0e-8523-d3c8fdc93e01"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"544096dc-c098-4d0e-8523-d3c8fdc93e01"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"544096dc-c098-4d0e-8523-d3c8fdc93e01"}],"recentChangeFlags":null},{"id":"98bb98fa-e30e-4915-9312-6eb8781c0cd2","uri":"https://www.mpsconnect.com.au","name":"www.mpsconnect.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fce1bfad-ec20-4a08-8ee1-d1b43ea0e0d3","sortOrder":19},"sortOrder":19,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"98bb98fa-e30e-4915-9312-6eb8781c0cd2"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"98bb98fa-e30e-4915-9312-6eb8781c0cd2"},{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"98bb98fa-e30e-4915-9312-6eb8781c0cd2"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"98bb98fa-e30e-4915-9312-6eb8781c0cd2"},{"id":"73ea470f-6fb9-4636-900b-259e5466f37e","name":"Apache httpd","targetId":"98bb98fa-e30e-4915-9312-6eb8781c0cd2"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"98bb98fa-e30e-4915-9312-6eb8781c0cd2"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"98bb98fa-e30e-4915-9312-6eb8781c0cd2"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"98bb98fa-e30e-4915-9312-6eb8781c0cd2"}],"recentChangeFlags":null},{"id":"9d74b33f-acf1-46bd-9a6a-ca4cd1b28dfa","uri":"https://www.wagnerhealth.com.au/","name":"www.wagnerhealth.com.au/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ec96dc9f-3564-426f-b3bf-8cc1507fc669","sortOrder":20},"sortOrder":20,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"9d74b33f-acf1-46bd-9a6a-ca4cd1b28dfa"},{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"9d74b33f-acf1-46bd-9a6a-ca4cd1b28dfa"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"9d74b33f-acf1-46bd-9a6a-ca4cd1b28dfa"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"9d74b33f-acf1-46bd-9a6a-ca4cd1b28dfa"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"9d74b33f-acf1-46bd-9a6a-ca4cd1b28dfa"}],"recentChangeFlags":null},{"id":"e93f743b-1cd9-42f4-aef2-9600f2488784","uri":"https://rsvp.chemistwarehouse.com.au/","name":"rsvp.chemistwarehouse.com.au ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8f5b68e3-31c8-462d-b36f-27c5c2859b06","sortOrder":22},"sortOrder":22,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"e93f743b-1cd9-42f4-aef2-9600f2488784"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"e93f743b-1cd9-42f4-aef2-9600f2488784"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"e93f743b-1cd9-42f4-aef2-9600f2488784"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"e93f743b-1cd9-42f4-aef2-9600f2488784"}],"recentChangeFlags":null},{"id":"95db453b-a351-41b8-a60a-41e769d8092b","uri":"https://www.mybeautyspot.com.au","name":"www.mybeautyspot.com.au ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7df39e7e-50a3-454a-9663-8ada674d72d7","sortOrder":24},"sortOrder":24,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"95db453b-a351-41b8-a60a-41e769d8092b"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"95db453b-a351-41b8-a60a-41e769d8092b"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"eb4c047d-2f1a-4525-8065-5494bf183334","name":"Out of Scope","targets":[{"id":"cc2d43c8-65d9-4f45-8b9e-58e7c737352f","uri":"","name":"*.chemistwarehouse.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6f73c27a-360b-4d90-83ba-60ba88c4cff7","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cc2d43c8-65d9-4f45-8b9e-58e7c737352f"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"46e53707-788d-4f26-bdb5-26169beaa883","code":"chemistwarehouse-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"4b22c3da-7ef3-413d-be24-71b97e9bc9ab","startsAt":"2025-07-22T21:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/2d6a/1181/b5d6c999/ef945440868a559b76334cf35c09929e_my_chemist_warehouse_group_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-07-22T21:00:00.024Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/chemistwarehouse-vdp-pro","changelogs":"/engagements/chemistwarehouse-vdp-pro/changelog","submissions":null,"announcements":"/engagements/chemistwarehouse-vdp-pro/announcements","hallOfFame":"/engagements/chemistwarehouse-vdp-pro/hall_of_fames","crowdstream":"/engagements/chemistwarehouse-vdp-pro/crowdstream"},"announcementsCount":2,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/chemistwarehouse-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=chemistwarehouse-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/chemistwarehouse-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/chemistwarehouse-vdp-pro/changelog","publishedAt":"2026-04-06T06:40:56.480Z","engagementChangelogUrl":"/engagements/chemistwarehouse-vdp-pro/changelog/53291dfd-8e6f-47b3-8fb6-9ac48fd1b8f1","createUserFeedbacksUrl":"/engagements/chemistwarehouse-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/chemistwarehouse-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}