{"id":"da7d47d3-7377-46c0-bd3a-bb231baa55a9","engagementId":"4831b196-c1c4-44a3-99a7-45bd79f694a6","data":{"brief":{"id":"2939fc1d-c5e0-42c8-8dc1-031281f156f8","name":"ClassDojo","tagline":"ClassDojo is on a mission to help every teacher create an incredible classroom","description":"\u003cp\u003eClassDojo is committed to working with security experts across the world to stay up to date with the latest security techniques and to protect the information entrusted to us by our users. If you have discovered a security issue that you believe we should know about, we'd welcome working with you. We will make every effort to acknowledge and address security issues as fast as possible.  Good luck and happy hunting!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eEligibility\u003c/h1\u003e\n\n\u003cp\u003eWhen you are investigating and reporting, we ask that you:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eShare the details of the security vulnerabilities with us exclusively via Bugcrowd tools\u003c/li\u003e\n\u003cli\u003eGive us reasonable amount of time to acknowledge, research, and implement fix for the issues when applicable, before any public disclosure\u003c/li\u003e\n\u003cli\u003eUse your own testing accounts and not modify, access, or affect other users' accounts and account information in any way\u003c/li\u003e\n\u003cli\u003eDo not use automated tools that could potentially degrade the performance of our service\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eWhile we welcome reports about best practices, unless a report leads to an exploit that materially affects the security and privacy of ClassDojo users, it will not be eligible for a bounty.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eRatings/Rewards\u003c/h1\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact (see below). In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"f2d64fa8-5daf-49ef-8de8-edc7da2dfb4a","targetsOverview":"\u003cp\u003e\u003cem\u003eAny domain/property of ClassDojo not listed in the targets section above is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eAll targets are publicly accessible. Please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eWhen setting up your account, please set your school to be the 'Bugcrowd testing school'.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eYou are required to add an identifying user-agent string to the header of your requests: [UA-BUGCROWD] \u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAdditionally, the ClassDojo program limits the use of automated scanners to one request a second. Failure to follow these guidelines could result in removal from the program. \u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eHigh-Level Overview\u003c/h2\u003e\n\n\u003cp\u003eIn order to understand how we evaluate impact you must first understand user types and group types. \u003c/p\u003e\n\n\u003ch3\u003eUser Types\u003c/h3\u003e\n\n\u003cp\u003eClassDojo has the following user types:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eSchool Leader / Admin\u003c/li\u003e\n\u003cli\u003eTeacher\u003c/li\u003e\n\u003cli\u003eParent\u003c/li\u003e\n\u003cli\u003eStudent\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eGroup Types\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eSchool\u003c/li\u003e\n\u003cli\u003eClass\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eUser \u0026amp; Group Relationships\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eSchool Leaders/Admins \"own\" a school\u003c/li\u003e\n\u003cli\u003eClasses can belong to either a school or a teacher or both \u003cstrong\u003eNote: it is possible for a class to not belong to a school\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003eTeachers are connected to a school and to classes they are added as collaborators to\u003c/li\u003e\n\u003cli\u003eTeachers \"own\" classes they've created or are assigned ownership of by a School Leader\u003c/li\u003e\n\u003cli\u003eStudents are connected to schools or to classes or both\u003c/li\u003e\n\u003cli\u003eParents are connected to students via class/school, or \"at home\"\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eNotes on Impact\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe highest severity bugs for ClassDojo are those bugs where a user is able to read or modify data across a connection boundary, especially if that data is considered PII. For example, a teacher can read/write private data to classes outside their school.\u003c/li\u003e\n\u003cli\u003eSimilarly high impact are any vulnerabilities that allow parents to read/write private data to students/children they are not connected to.\u003c/li\u003e\n\u003cli\u003eGenerally speaking, if you identify a vulnerability that lets you read/write to an object using an object identifier, we will consider the impact higher if you're able to enumerate the identifier and encourage you to look for such enumeration as a part of your research process. \u003c/li\u003e\n\u003cli\u003eWhile we want to know about vulnerabilities across class boundaries within a school (e.g. a teacher can read/write on a class in their school even if they are not connected to that class as a co-teacher), this type of vulnerability will always be lower impact than the same vulnerability across schools\u003c/li\u003e\n\u003cli\u003eLastly, we generally do not consider a mismatch between UI and API to have security impact as we often will make changes to the API first for features we intend to add in future UI updates. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eGuidelines\u003c/h2\u003e\n\n\u003cp\u003ePlease adhere to the following guidelines in order to be eligible for rewards under this program:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not permanently modify or delete ClassDojo-hosted data.\u003c/li\u003e\n\u003cli\u003eDo not intentionally access non-public ClassDojo data any more than is necessary to demonstrate the vulnerability.\u003c/li\u003e\n\u003cli\u003eDo not DDoS or otherwise disrupt, interrupt or degrade our internal or external services.\u003c/li\u003e\n\u003cli\u003eDo not share confidential information obtained from ClassDojo, including but not limited to member or -\ndonor payment information, with any third party.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eThese categories of vulnerabilities are not covered in our reward program:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eVulnerabilities affecting users of outdated browsers or platforms\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting users of rooted mobile devices\u003c/li\u003e\n\u003cli\u003eUse of a known-vulnerable library which does not lead to a vulnerability in our service\u003c/li\u003e\n\u003cli\u003eForms missing CSRF tokens which do not lead to a vulnerability\u003c/li\u003e\n\u003cli\u003eMissing SPF/DKIM/DMARC records\u003c/li\u003e\n\u003cli\u003eInsecure SSL/TLS ciphers which do not lead to a vulnerability\u003c/li\u003e\n\u003cli\u003eCookies missing secure flag\u003c/li\u003e\n\u003cli\u003eMissing security headers which do not lead to a vulnerability\u003c/li\u003e\n\u003cli\u003eReports from automated tools or scans\u003c/li\u003e\n\u003cli\u003ePassword and account recovery policies, such as reset link expiration, password complexity, and session lifecycle. This includes (but is not limited to): not logging out other sessions when a user changes a password, not requiring an existing password to change a password, sessions not getting logged out when there is an extended amount of inactivity, deleting an account while logged in without a password, receiving email confirmation when you've updated your email, etc.)\u003c/li\u003e\n\u003cli\u003eEmail spam from user actions, e.g. no rate limits on invitations\u003c/li\u003e\n\u003cli\u003eDenial of service vulnerabilities\u003c/li\u003e\n\u003cli\u003eStack traces or file-path exposure\u003c/li\u003e\n\u003cli\u003eMobile vulnerabilities requiring users to be tricked into installing an unrelated malicious application. (e.g. Strandhogg, etc.) \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"6b44aa17-bf27-4883-8107-e7e83db6c822","name":"In Scope (Priority Targets)","targets":[{"id":"4f52725f-099e-4046-8924-f8d020e225ca","uri":"https://apps.apple.com/us/app/classdojo/id552602056","name":"IoS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9a46cd26-1992-4f2a-8038-75fd89345569","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"4f52725f-099e-4046-8924-f8d020e225ca"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"4f52725f-099e-4046-8924-f8d020e225ca"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"4f52725f-099e-4046-8924-f8d020e225ca"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"4f52725f-099e-4046-8924-f8d020e225ca"},{"id":"cc05697c-58bf-4b7b-a2b5-2ba0ead3270b","name":"Binary Analysis","targetId":"4f52725f-099e-4046-8924-f8d020e225ca"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"4f52725f-099e-4046-8924-f8d020e225ca"}],"recentChangeFlags":null},{"id":"b641c72b-741d-4679-bbce-6d733e355f0d","uri":"https://api.classdojo.com","name":"https://api.classdojo.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b5f42327-ed9d-4fed-837d-7bedd5a26d1b","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"b641c72b-741d-4679-bbce-6d733e355f0d"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"b641c72b-741d-4679-bbce-6d733e355f0d"}],"recentChangeFlags":null},{"id":"f8234fa0-92e5-42a2-bef7-bb4545e82a50","uri":"https://play.google.com/store/apps/details?id=com.classdojo.android","name":"Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c3d4d77e-10da-4fbf-8378-4d9d9f53370c","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"f8234fa0-92e5-42a2-bef7-bb4545e82a50"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"f8234fa0-92e5-42a2-bef7-bb4545e82a50"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"f8234fa0-92e5-42a2-bef7-bb4545e82a50"},{"id":"cc05697c-58bf-4b7b-a2b5-2ba0ead3270b","name":"Binary Analysis","targetId":"f8234fa0-92e5-42a2-bef7-bb4545e82a50"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"f8234fa0-92e5-42a2-bef7-bb4545e82a50"}],"recentChangeFlags":null},{"id":"41da4201-6e83-4a81-9f55-7cc251f02b46","uri":"https://teach.classdojo.com","name":"https://teach.classdojo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3911856e-2df9-4e37-ae8a-db0a3664e37f","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"41da4201-6e83-4a81-9f55-7cc251f02b46"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"41da4201-6e83-4a81-9f55-7cc251f02b46"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"41da4201-6e83-4a81-9f55-7cc251f02b46"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"41da4201-6e83-4a81-9f55-7cc251f02b46"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"41da4201-6e83-4a81-9f55-7cc251f02b46"}],"recentChangeFlags":null},{"id":"59832ef1-32d2-48eb-aca9-5c62c0654102","uri":"https://student.classdojo.com","name":"https://student.classdojo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"399f148f-311d-42a5-9e2a-1c6d95f284bd","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"59832ef1-32d2-48eb-aca9-5c62c0654102"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"59832ef1-32d2-48eb-aca9-5c62c0654102"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"59832ef1-32d2-48eb-aca9-5c62c0654102"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"59832ef1-32d2-48eb-aca9-5c62c0654102"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"59832ef1-32d2-48eb-aca9-5c62c0654102"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"59832ef1-32d2-48eb-aca9-5c62c0654102"}],"recentChangeFlags":null},{"id":"59a9745f-082b-4575-90a5-f39b7de72836","uri":"https://www.classdojo.com","name":"https://www.classdojo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1780b1a3-3cf7-4fdd-a2d8-5a66744d3834","sortOrder":0},"sortOrder":0,"tags":[{"id":"21bf0b21-e645-4730-b030-be773c64efc7","name":"Gatsby","targetId":"59a9745f-082b-4575-90a5-f39b7de72836"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"59a9745f-082b-4575-90a5-f39b7de72836"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"59a9745f-082b-4575-90a5-f39b7de72836"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"59a9745f-082b-4575-90a5-f39b7de72836"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"59a9745f-082b-4575-90a5-f39b7de72836"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"59a9745f-082b-4575-90a5-f39b7de72836"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"59a9745f-082b-4575-90a5-f39b7de72836"}],"recentChangeFlags":null},{"id":"5b474c9e-0add-4317-a4bb-5765ac451091","uri":"https://home.classdojo.com","name":"https://home.classdojo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5076a36d-33fb-40bd-919d-f5f0e3bda74b","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"5b474c9e-0add-4317-a4bb-5765ac451091"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"5b474c9e-0add-4317-a4bb-5765ac451091"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"5b474c9e-0add-4317-a4bb-5765ac451091"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"5b474c9e-0add-4317-a4bb-5765ac451091"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5b474c9e-0add-4317-a4bb-5765ac451091"}],"recentChangeFlags":null},{"id":"b454f1e8-8924-4b52-9cd3-d5ba3352791d","uri":"https://dev.tutoring.classdojo.com","name":"https://dev.tutoring.classdojo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"befe10e4-3aff-4381-999a-8762f093c2f2","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"b454f1e8-8924-4b52-9cd3-d5ba3352791d"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"b454f1e8-8924-4b52-9cd3-d5ba3352791d"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"b454f1e8-8924-4b52-9cd3-d5ba3352791d"}],"recentChangeFlags":null},{"id":"10777a4a-d66f-4802-bad9-db2c754878f2","uri":"https://ws.multiplayer.classdojo.com/","name":"wss://ws.multiplayer.classdojo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"90a1e569-5d0a-479f-8dfb-1c2540b967b7","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"10777a4a-d66f-4802-bad9-db2c754878f2"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"10777a4a-d66f-4802-bad9-db2c754878f2"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"10777a4a-d66f-4802-bad9-db2c754878f2"}],"recentChangeFlags":null},{"id":"33955062-fb4d-46d9-a4ef-3057049adfdc","uri":"https://ticket.multiplayer.classdojo.com","name":"https://ticket.multiplayer.classdojo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"899b7cc2-c617-41fb-9d07-bc4a7ca6fc45","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"33955062-fb4d-46d9-a4ef-3057049adfdc"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"33955062-fb4d-46d9-a4ef-3057049adfdc"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"33955062-fb4d-46d9-a4ef-3057049adfdc"}],"recentChangeFlags":null},{"id":"7430f8d1-aafa-4f92-a319-44005faf3f2a","uri":"https://clients.multiplayer.classdojo.com/launcher/prod/latest","name":"https://clients.multiplayer.classdojo.com/launcher/prod/latest","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b75f118c-10b0-4eaa-8d1b-27b111a22317","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"7430f8d1-aafa-4f92-a319-44005faf3f2a"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"7430f8d1-aafa-4f92-a319-44005faf3f2a"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"7430f8d1-aafa-4f92-a319-44005faf3f2a"}],"recentChangeFlags":null},{"id":"bdf9fc58-2786-44ce-982a-f93369af1fcc","uri":"https://monster-customizer.classdojo.com/cf6dfa68-1a81-4c6d-bc0b-38f3666b37d6/index.html","name":"https://monster-customizer.classdojo.com/cf6dfa68-1a81-4c6d-bc0b-38f3666b37d6/index.html","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"97ef7e55-ac25-4112-9033-c0b9ef28909c","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"bdf9fc58-2786-44ce-982a-f93369af1fcc"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"bdf9fc58-2786-44ce-982a-f93369af1fcc"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"bdf9fc58-2786-44ce-982a-f93369af1fcc"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"e280940e-9e44-4151-a54b-c16a492f3d0b","p1MaxCents":250000,"p1MinCents":150000,"p2MaxCents":150000,"p2MinCents":50000,"p3MaxCents":50000,"p3MinCents":5000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1500,"max":2500},"2":{"min":500,"max":1500},"3":{"min":50,"max":500},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"9cefc41b-965c-462f-b0c2-2521e723496f","name":"In Scope (Discovery Targets)","targets":[{"id":"22972352-c991-4acc-925f-e14bbbba0ac6","uri":"","name":"*.classdojo.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2374875a-62d0-4d63-871e-1ee172af94dd","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"22972352-c991-4acc-925f-e14bbbba0ac6"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"22972352-c991-4acc-925f-e14bbbba0ac6"}],"recentChangeFlags":null},{"id":"372c4a0b-5f15-4b50-a6a3-493da231c741","uri":"","name":"*.classdojo.co.uk","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"55996f71-2cde-45b4-bac7-0942f5c54333","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"372c4a0b-5f15-4b50-a6a3-493da231c741"}],"recentChangeFlags":null},{"id":"5496404b-2be8-432f-9998-2bc3c84d5af7","uri":"","name":"*.doj.io","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"801e64b2-a7b7-4a79-930a-b7e16de9d1c7","sortOrder":2},"sortOrder":2,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"5496404b-2be8-432f-9998-2bc3c84d5af7"}],"recentChangeFlags":null},{"id":"41c3d803-72c9-4272-a8dd-fa719bbb6b0f","uri":"","name":"*.dojo.me","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"dff01bf4-a68f-4988-a2aa-55a9f90a89b7","sortOrder":3},"sortOrder":3,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"41c3d803-72c9-4272-a8dd-fa719bbb6b0f"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eClassDojo welcomes testing against the listed targets beyond what is listed explicitly in other sections. For the time being, only points will be rewarded for bugs found against these targets.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"2f9ce2f0-7077-412d-83e4-34e01b50a246","name":"Out of Scope","targets":[{"id":"6d105552-ee9c-4507-8fce-8e75745647fb","uri":"https://shop.classdojo.com","name":"https://shop.classdojo.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9342a53f-b145-4b32-a549-0a6040aa9b5b","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThese URL paths are out of scope.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"4831b196-c1c4-44a3-99a7-45bd79f694a6","code":"classdojo","state":"in_progress","endsAt":null,"bountyId":"fbab0a6d-bd76-430f-b2cd-f52253c7d624","startsAt":"2019-01-10T19:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Education","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/706e/6dc4/5694fad1/1b39412dbdeccfb31985fa1cd611c522_dojo_logo.png","logoBackgroundColor":"#575b7D","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2019-01-10T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/classdojo","changelogs":"/engagements/classdojo/changelog","submissions":null,"announcements":"/engagements/classdojo/announcements","hallOfFame":"/engagements/classdojo/hall_of_fames","crowdstream":null},"announcementsCount":16,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/classdojo/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=classdojo\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/classdojo/engagement_subscribers","engagementChangelogsUrl":"/engagements/classdojo/changelog","publishedAt":"2026-02-05T23:53:36.468Z","engagementChangelogUrl":"/engagements/classdojo/changelog/da7d47d3-7377-46c0-bd3a-bb231baa55a9","createUserFeedbacksUrl":"/engagements/classdojo/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}