{"id":"975d97fd-8795-42ca-8d4d-ea588b94027a","engagementId":"a0d044b6-af1d-44a1-87a2-50b388f2a572","data":{"brief":{"id":"2a54c8cf-9161-445c-ab75-bc937814db4a","name":"Citi's Responsible Disclosure Program","tagline":"Responsible Disclosure Program","description":"\u003ch1\u003eWelcome to Citi’s Responsible Disclosure Program\u003c/h1\u003e\n\n\u003cp\u003eThe responsible disclosure of security vulnerabilities helps us ensure the security and privacy of Citi and our customers. \u003cbr\u003e\nTo make a disclosure you'll need to first \u003ca href=\"https://bugcrowd.com/user/sign_up\" title=\"Bugcrowd sign up\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esign up with Bugcrowd\u003c/a\u003e. \u003c/p\u003e\n\n\u003cp\u003ePlease be aware Citi will not correspond with you directly, disclose remediation steps, or timeframes. \u003cbr\u003e\nYou should not publicize or disclose your submission or its results to any third parties without Citi's explicit permission to do so.\u003c/p\u003e\n\n\u003cp\u003eThis program adheres to the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for the prioritization/rating of findings.\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003chr\u003e\n\n\u003ch2\u003eProgram Rules\u003c/h2\u003e\n\n\u003ch2\u003eVulnerability reports on the same vulnerability across different target apps belonging to this program will be counted as one submission. Please submit a single report.\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eCross-environment findings will be considered duplicates. If you would like to group together one finding found across multiple environments, feel free to send them along!\u003c/em\u003e\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch1\u003eOut of Scope Items\u003c/h1\u003e\n\n\u003cp\u003eThis program \u003cstrong\u003eis not\u003c/strong\u003e intended for submitting complaints about Citi's services or products, reporting issues with ATMs, fraud, malware or asking questions about the availability of Citi's websites or mobile banking services. This program \u003cstrong\u003eis also not\u003c/strong\u003e intended for submitting suspicious or phishing e-mails. \u003cbr\u003e\nPlease report suspicious e-mails or phishing to \u003cem\u003espoof@citi.com\u003c/em\u003e.\u003c/p\u003e\n\n\u003cp\u003ePlease note that this program \u003cstrong\u003eshould not\u003c/strong\u003e be construed as encouragement or permission to perform any of the following activities:\u003cbr\u003e\n• Hack, penetrate or otherwise attempt to gain unauthorized access to Citi software or systems in violation of applicable law\u003cbr\u003e\n• Disclose or use any proprietary or confidential Citi info or data, including any customer data\u003cbr\u003e\n• Adversely impact Citi or the operation of Citi software or systems\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eDuring Remote Code Execution (RCE) vulnerability testing, researchers must strictly adhere to the guiding principle of confirming execution without compromising system state, data, or availability. Permitted activities are confined exclusively to minimal proof-of-execution validations—such as benign commands (whoami, id, hostname) or out-of-band DNS/HTTP callbacks (nslookup, curl) for blind execution. All other activity is strictly forbidden and carry risks of program disqualification and legal liability.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eCiti does not waive any rights or claims with respect to such activities\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"59d18adf-a3b1-4eac-982a-73973f97d9ec","name":"In-Scope","targets":[{"id":"7a506b9a-bb54-48cf-a762-6ebdb4175ac0","uri":"","name":"Any Citigroup owned asset","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a52702d3-6a8b-4c6a-9e42-d17754ff22fd","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"a0d044b6-af1d-44a1-87a2-50b388f2a572","code":"citi","state":"in_progress","endsAt":null,"bountyId":"8118a69e-c1d9-4c31-9619-17d5ff440682","startsAt":"2020-03-12T01:01:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/46b1/5ce2/1655a0c8/e547186dfcd35a70913ad3d2b52b7daf_bc_CitiLogo.jpeg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-03-12T01:01:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/citi","changelogs":"/engagements/citi/changelog","submissions":null,"announcements":"/engagements/citi/announcements","hallOfFame":"/engagements/citi/hall_of_fames","crowdstream":null},"announcementsCount":1,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/citi/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=citi\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/citi/engagement_subscribers","engagementChangelogsUrl":"/engagements/citi/changelog","publishedAt":"2026-09-15T22:01:15.348Z","engagementChangelogUrl":"/engagements/citi/changelog/975d97fd-8795-42ca-8d4d-ea588b94027a","createUserFeedbacksUrl":"/engagements/citi/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}