{"id":"51e897d2-43f4-4c73-b356-cea9059a09b3","engagementId":"2ef36a8a-f3af-49fd-9c31-961325d5a255","data":{"brief":{"id":"46bf6735-8e54-4303-a54a-2719062d9c8f","name":"Coles Group Limited Vulnerability Disclosure Program","tagline":"Coles Group is one of Australia’s largest and most iconic retailers, with more than 2,400 outlets across our portfolio of Australian supermarkets, liquor and convenience stores. Please submit your findings to this Vulnerability Disclosure Program.","description":"\u003cp\u003eColes is one of Australia’s leading retailers, with an extensive footprint of more than 2,400 retail outlets nationally. Coles employs more than 120,000 team members, engages with more than 8,000 suppliers, and welcomes millions of customers through its store network and digital platforms every week. Coles is committed to delivering consistently high-quality fresh food, product innovation, long-term partnerships with suppliers and great value for its customers.\u003c/p\u003e\n\n\u003cp\u003eColes understands the importance of securing our systems so we can continue to help Australians eat and live better every day. We are excited to work with highly skilled security researchers who can help us identify any weaknesses or vulnerabilities in our systems. \u003cbr\u003e\nGood luck, and happy hunting!\u003c/p\u003e\n\n\u003cp\u003eFor account sign ups please use your Bugcrowd email address.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed above as in scope. Any domain/property of Coles Group Limited not listed in the targets section is out of scope. Testing of subdomains should be limited to such subdomains and services that underpin functionality of the primary targets listed as in scope.\u003c/p\u003e\n\n\u003cp\u003ePlease note that Coles at times leverages 3rd parties and partners for some of its services. While some of these may be hosted on subdomains of the targets listed, we cannot authorise testing of these services. \u003c/p\u003e\n\n\u003cp\u003eIf you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Coles Group Limited, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eColes have a WAF in place with some Geo IP restrictions being enforced. \u003c/p\u003e\n\n\u003cp\u003eResearchers can create a free account on the Coles website. Please use your Bugcrowd Ninja email address when creating a testing account. \u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://owasp.org/www-project-top-ten/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOWASP top ten vulnerabilities \u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIDOR and broken access control\u003c/li\u003e\n\u003cli\u003eAccount take over \u003c/li\u003e\n\u003cli\u003eExposure of PII and customer data \u003c/li\u003e\n\u003cli\u003eSecurity control misconfigurations \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePayments, please do not process real orders with test or real credit cards. Coles are unable to refund orders if they are paid and processed. \u003c/li\u003e\n\u003cli\u003eDenial of service attacks \u003c/li\u003e\n\u003cli\u003eSub domain takeover\u003c/li\u003e\n\u003cli\u003eCredential Stuffing/Password Spraying attacks\u003c/li\u003e\n\u003cli\u003eStored XSS that might affect any account not owned by you\u003c/li\u003e\n\u003cli\u003eColes utilises and hosts several third-party providers and services which may be listed as subdomains of those which are in scope (For example Flybuys Loyalty). We cannot authorise testing against these systems, if unclear please ask via support@bugcrowd.com.\u003c/li\u003e\n\u003cli\u003eSocial engineering, phishing or any direct contact with Coles employees, their physical offices / brick and mortar stores\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRules of Engagement\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eCreate your Coles testing account with your Bugcrowd ninja email address.\u003c/li\u003e\n\u003cli\u003eTest only in-scope systems and respect out-of-scope systems.\u003c/li\u003e\n\u003cli\u003eRefrain from accessing, modifying, or using data belonging to others. If a vulnerability exposes such data, stop testing, submit a report immediately, and delete all copies of the information.\u003c/li\u003e\n\u003cli\u003eRefrain from activities that would be disruptive to Coles business and their users.\u003c/li\u003e\n\u003cli\u003eRefrain from Posting, transmitting, uploading, linking to, sending, or storing any malicious software\u003c/li\u003e\n\u003cli\u003eMaintain communication via Bugcrowd offical channels (this VDP). See \u003ca href=\"https://www.bugcrowd.com/resources/essentials/standard-disclosure-terms/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowds standard disclosure terms. \u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eKeep vulnerability details confidential unless authorised by Coles to discuss them with any third parties.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"240eb9bc-b361-4ab3-a48f-23f5ba577f64","name":"█████████","targets":[{"id":"be3ba186-3319-4b99-b5ea-193454aeac15","uri":null,"name":"████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"133b91f4-06fd-4426-8ff2-754e99f267e0","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"be3ba186-3319-4b99-b5ea-193454aeac15"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"be3ba186-3319-4b99-b5ea-193454aeac15"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"be3ba186-3319-4b99-b5ea-193454aeac15"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"be3ba186-3319-4b99-b5ea-193454aeac15"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"be3ba186-3319-4b99-b5ea-193454aeac15"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"be3ba186-3319-4b99-b5ea-193454aeac15"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"be3ba186-3319-4b99-b5ea-193454aeac15"}],"recentChangeFlags":null},{"id":"fe027ff9-4341-465f-accd-45dbc685b223","uri":null,"name":"██████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"13b5834d-192d-4de6-9a87-44b3453f1206","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"fe027ff9-4341-465f-accd-45dbc685b223"},{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"fe027ff9-4341-465f-accd-45dbc685b223"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"fe027ff9-4341-465f-accd-45dbc685b223"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"fe027ff9-4341-465f-accd-45dbc685b223"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fe027ff9-4341-465f-accd-45dbc685b223"}],"recentChangeFlags":null},{"id":"0635c4c5-ba02-49f5-9669-bff7ed873622","uri":null,"name":"██████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f2e55613-4765-4202-a780-98aacece7965","sortOrder":0},"sortOrder":0,"tags":[{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"0635c4c5-ba02-49f5-9669-bff7ed873622"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0635c4c5-ba02-49f5-9669-bff7ed873622"}],"recentChangeFlags":null},{"id":"9e28ba2a-bf5b-491d-b045-9e1034aee16f","uri":null,"name":"█████████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a741e575-0444-47aa-85b4-66ced3fff828","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"9e28ba2a-bf5b-491d-b045-9e1034aee16f"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"9e28ba2a-bf5b-491d-b045-9e1034aee16f"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"9e28ba2a-bf5b-491d-b045-9e1034aee16f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9e28ba2a-bf5b-491d-b045-9e1034aee16f"}],"recentChangeFlags":null},{"id":"b7bdc5db-c315-45e0-bcb5-1e31af71ce2d","uri":null,"name":"████████████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"16d4c695-a1a6-4fcb-a50f-636de930ee45","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"b7bdc5db-c315-45e0-bcb5-1e31af71ce2d"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"b7bdc5db-c315-45e0-bcb5-1e31af71ce2d"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"b7bdc5db-c315-45e0-bcb5-1e31af71ce2d"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b7bdc5db-c315-45e0-bcb5-1e31af71ce2d"}],"recentChangeFlags":null},{"id":"d296f69a-9665-4d02-bac5-5d3f30c8d73e","uri":null,"name":"███████████████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c97ac59d-1329-4b07-a2f4-d579d992db99","sortOrder":0},"sortOrder":0,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"d296f69a-9665-4d02-bac5-5d3f30c8d73e"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"d296f69a-9665-4d02-bac5-5d3f30c8d73e"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"d296f69a-9665-4d02-bac5-5d3f30c8d73e"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"d296f69a-9665-4d02-bac5-5d3f30c8d73e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d296f69a-9665-4d02-bac5-5d3f30c8d73e"}],"recentChangeFlags":null},{"id":"2047c066-f0bf-488e-9315-28bcd36fea98","uri":null,"name":"███████████████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"06d590b1-0b40-4ad7-984d-5ddce692fa34","sortOrder":0},"sortOrder":0,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"2047c066-f0bf-488e-9315-28bcd36fea98"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"2047c066-f0bf-488e-9315-28bcd36fea98"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"2047c066-f0bf-488e-9315-28bcd36fea98"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"2047c066-f0bf-488e-9315-28bcd36fea98"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2047c066-f0bf-488e-9315-28bcd36fea98"}],"recentChangeFlags":null},{"id":"4550d0a4-ee38-4613-baed-72ecc5c29f73","uri":null,"name":"██████████████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"936afb78-875a-4a80-85c7-84426bb9109f","sortOrder":0},"sortOrder":0,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"4550d0a4-ee38-4613-baed-72ecc5c29f73"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"4550d0a4-ee38-4613-baed-72ecc5c29f73"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"4550d0a4-ee38-4613-baed-72ecc5c29f73"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"4550d0a4-ee38-4613-baed-72ecc5c29f73"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4550d0a4-ee38-4613-baed-72ecc5c29f73"}],"recentChangeFlags":null},{"id":"f0db9e49-d496-41b6-a4b0-df88b37a726c","uri":null,"name":"██████████████████████████████████████","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9a0c98e0-a8c7-4e20-a59d-b3496cacdae4","sortOrder":8},"sortOrder":8,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"f0db9e49-d496-41b6-a4b0-df88b37a726c"}],"recentChangeFlags":null},{"id":"34ebed8c-0710-4e83-9348-1dc716d26a2d","uri":null,"name":"███████████████████████████████████████████████████","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9ea704d4-7b8e-446e-a0ca-27ad68cf800c","sortOrder":9},"sortOrder":9,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"34ebed8c-0710-4e83-9348-1dc716d26a2d"}],"recentChangeFlags":null},{"id":"d52d12f5-fc58-45a5-b67c-1193963ee09b","uri":null,"name":"█████████████████████████████████████████████████████████████████████","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ce4d92de-b308-46af-9718-75df86212707","sortOrder":10},"sortOrder":10,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d52d12f5-fc58-45a5-b67c-1193963ee09b"}],"recentChangeFlags":null},{"id":"4c0141e0-8831-4e0a-94ed-6ef16f170fef","uri":null,"name":"█████████████████████████████████████████████████","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ec784e59-9296-48dd-99ce-7dc23eb4a68c","sortOrder":11},"sortOrder":11,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"4c0141e0-8831-4e0a-94ed-6ef16f170fef"}],"recentChangeFlags":null},{"id":"cbe3794c-fc4e-4328-8bc8-54f2f35ccd56","uri":null,"name":"████████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4c72f83e-86cf-4072-88ee-bac5543f5cb6","sortOrder":12},"sortOrder":12,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cbe3794c-fc4e-4328-8bc8-54f2f35ccd56"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"67d4051f-b8f9-4006-b9df-f97e6ff5c897","name":"█████████████","targets":[{"id":"54b13bc0-93fb-4f38-af05-de4ca6f7d5d4","uri":null,"name":"████████","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8d7d1262-34c8-44f0-b9ca-2fe44a411a0f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"b96c472e-1d3c-4655-802f-19cb92937d80","uri":null,"name":"██████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"789ff2d9-462d-4142-9cfe-c1aebe65b8ab","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b96c472e-1d3c-4655-802f-19cb92937d80"}],"recentChangeFlags":null},{"id":"8a20167e-8414-493e-bf94-d9b1fe4593b3","uri":null,"name":"█████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6b61d954-e1ad-49a9-86e1-052edc292a6e","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8a20167e-8414-493e-bf94-d9b1fe4593b3"}],"recentChangeFlags":null},{"id":"0baf0713-6316-459e-98e9-5ccd1bf04fe7","uri":null,"name":"███████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c4ff777f-6e0e-47b6-98a1-2bb40305ea16","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0baf0713-6316-459e-98e9-5ccd1bf04fe7"}],"recentChangeFlags":null},{"id":"0fdba355-e888-4fbc-8719-41ce5127236e","uri":null,"name":"██████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8a48c698-1d7a-4659-936d-d5d7e04efc29","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0fdba355-e888-4fbc-8719-41ce5127236e"}],"recentChangeFlags":null},{"id":"7b960b42-8c39-42e1-9920-4c6bc202cbb0","uri":null,"name":"███████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"22feec78-f697-425a-a771-506c45c895fb","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7b960b42-8c39-42e1-9920-4c6bc202cbb0"}],"recentChangeFlags":null},{"id":"67d93da2-152d-4f5e-82bb-2359e7105624","uri":null,"name":"█████████████████████","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9c3568e4-f15b-4f82-ba9b-cf8f5ad325a1","sortOrder":0},"sortOrder":0,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"67d93da2-152d-4f5e-82bb-2359e7105624"}],"recentChangeFlags":null},{"id":"61b30c70-45b9-4e7b-a40c-63cd3cec012f","uri":null,"name":"█████████████████████████","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"aefe21b3-d835-42ff-a5fa-9c8d5030a567","sortOrder":0},"sortOrder":0,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"61b30c70-45b9-4e7b-a40c-63cd3cec012f"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"2ef36a8a-f3af-49fd-9c31-961325d5a255","code":"coles-vdp-pro","state":"in_progress_paused","endsAt":null,"bountyId":"71ec3949-ccd0-4514-b1d4-743d3cfe64de","startsAt":"2023-11-23T00:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/f2ee/a045/ca75335e/14ed9695fc252cf5815584f1c0c0b6f1_ColesGroup.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":"Greetings Everyone! \n\nEffective immediately, the Coles VDP program is coming to an end. \n\nBugcrowd and Coles will be working together to continue triaging and validating all submissions that have come in to-date.\n\nWe are incredibly grateful for each of you and deeply appreciate all of your contributions over the years!\n\nIf you have any questions, please visit [Bugcrowd Support](https://bugcrowd-support.freshdesk.com/support/tickets/new) and create a support ticket.\n","lastTransitionAt":"2026-06-23T11:32:46.295Z","cancellationReason":null,"statusLabel":"In progress paused","routesPaths":{"brief":"/engagements/coles-vdp-pro","changelogs":"/engagements/coles-vdp-pro/changelog","submissions":null,"announcements":"/engagements/coles-vdp-pro/announcements","hallOfFame":"/engagements/coles-vdp-pro/hall_of_fames","crowdstream":"/engagements/coles-vdp-pro/crowdstream"},"announcementsCount":3,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":null,"methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=coles-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/coles-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/coles-vdp-pro/changelog","publishedAt":"2026-06-23T11:32:46.333Z","engagementChangelogUrl":"/engagements/coles-vdp-pro/changelog/51e897d2-43f4-4c73-b356-cea9059a09b3","createUserFeedbacksUrl":"/engagements/coles-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/coles-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}