{"id":"4ab5bb40-ae5d-41de-a87e-56dfc61a7a11","engagementId":"572e3bb1-8f49-4b17-9f3f-37e56920349c","data":{"brief":{"id":"c7c522e5-ba17-4d2b-8215-566ffed0cefd","name":"Etsy","tagline":"Help keep buyers and sellers across the world safe!","description":"\u003ch2\u003eProgram Overview\u003c/h2\u003e\n\n\u003cp\u003eEtsy is the global marketplace for unique and creative goods, connecting millions of buyers and sellers around the world. Through our marketplace and seller tools, we help creative entrepreneurs start, manage, and grow their businesses. Our mission is simple: \u003cstrong\u003eKeep Commerce Human\u003c/strong\u003e.\u003c/p\u003e\n\n\u003cp\u003eOur bug bounty program has been running since 2012, and it remains an important part of how we protect the Etsy community. We partner with security researchers who practice responsible disclosure and help us identify vulnerabilities that could impact the safety, trust, and resilience of our marketplace.\u003c/p\u003e\n\n\u003cp\u003eIf you discover a valid security issue, we want to hear from you.\u003c/p\u003e\n\n\u003cp\u003ePlease use your @bugcrowdninja.com email address when creating testing account(s). To protect the integrity of the program, we reserve the right to suspend, delete, or block any test accounts that violate our testing guidelines.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eVulnerability Guidelines \u0026amp; Exceptions\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eVulnerability reports MUST have a proof of concept or detailed explanation of the security issue. \u003c/li\u003e\n\u003cli\u003ePlease note the \u003ccode\u003eVulnerability Exceptions\u003c/code\u003e section for a list of vulnerabilities which are NOT accepted.\u003c/li\u003e\n\u003cli\u003eHigher quality reproduction steps and reports will be a strong factor in determining a valid issue's final bounty reward amount (In general, better reports -\u0026gt; bigger bounty reward). PLEASE provide clear step-by-step for replication.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRewards\u003c/h2\u003e\n\n\u003cp\u003eThis program adheres to the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for the prioritization/rating of findings. Changes to VRT priorities for certain bugs are listed below: \u003c/p\u003e\n\n\u003ch3\u003eVRT Adjustments\u003c/h3\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eVRT Category\u003c/th\u003e\n\u003cth\u003eAdjusted Value\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eNo Rate Limiting on Form - Login\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eNo Rate Limiting on Form - email triggering\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eCross-Site Scripting - IE-only/older version\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eUsername Enumeration\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eNo Password Policy\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003chr\u003e","industryTagId":"1bf3970a-395b-4456-b261-d04dab482af2","targetsOverview":"\u003cp\u003e\u003cem\u003eAny domain/property of Etsy not listed in the targets section is out of scope. This includes any/all domains not listed above.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cp\u003eThis program is focused on vulnerabilities in Etsy's mobile \u0026amp; web applications. These applications are used by Etsy customers and sellers. Additionally, the developer APIs and portal is also in-scope. \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eUnauthenticated access to users' accounts / information, especially PII (Personally Identifiable Information).\u003c/li\u003e\n\u003cli\u003eDeveloper API vulnerabilities.\n​\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eProduction Environment:\u003c/strong\u003e Please note that this program scope is a production environment. With that in mind, please be sure to avoid harming infrastructure, interacting with customers, and attempting to access, manipulate, and/or attack accounts you do not explicitly own. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess \u0026amp; Credentials:\u003c/h2\u003e\n\n\u003cp\u003eAll in-scope target applications are publicly accessible. Credentials can be self-provisioned as needed. \u003cstrong\u003ePlease only perform testing against accounts you expressly own and control.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch4\u003eBuyer and Seller Accounts\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eSeller Shop Sign-Up: \u003ca href=\"https://www.etsy.com/your/shop/create?us_sell_create_value\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.etsy.com/your/shop/create?us_sell_create_value\u003c/a\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease Note: when registering a Seller Shop, there is identity verification.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eBuyer Sign-Up: \u003ca href=\"https://www.etsy.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.etsy.com\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eTesting payment/purchasing flow:\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eCreate a seller account, selling something for $1\u003c/li\u003e\n\u003cli\u003eCreate a buyer account, buying the item for $1\u003c/li\u003e\n\u003cli\u003eAs the seller, refund the purchase\u003c/li\u003e\n\u003cli\u003eNOTE: there is a 20 cent fee (on a $1 purchase) associated with transactions for sellers - this cannot be reimbursed by Etsy. Please be cognizant of this and test accordingly.\n​------\n#### Third Party Bugs\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eEtsy uses a number of third-party providers and services. We cannot authorize security testing against systems that do not belong to us, but strongly suggest reporting issues identified within these services to the third-party directly.\u003c/p\u003e\n\n\u003cp\u003eHowever, if you believe an issue with one of our third-party service providers is the result of Etsy's misconfiguration or insecure usage of that service (or you've reported an issue affecting many customers of the service that you believe Etsy can temporarily mitigate without stopping usage of the service while a fix is implemented upstream), we'd appreciate your report regarding the issue.\u003c/p\u003e\n\n\u003ch2\u003eKeep in mind that any reports regarding third-party services are rewarded on a case-by-case basis.\u003c/h2\u003e\n\n\u003ch2\u003eTarget Information\u003c/h2\u003e\n\n\u003ch4\u003eMobile Applications\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eAndroid: \u003ca href=\"https://play.google.com/store/apps/details?id=com.etsy.android\u0026amp;hl=en\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://play.google.com/store/apps/details?id=com.etsy.android\u0026amp;hl=en\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eiPhone: \u003ca href=\"https://itunes.apple.com/us/app/etsy-shop-creative/id477128284?mt=8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://itunes.apple.com/us/app/etsy-shop-creative/id477128284?mt=8\u003c/a\u003e\n​\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eEtsy API (v3)\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eDocumentation for the Etsy API: \u003ca href=\"https://www.etsy.com/developers/documentation\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.etsy.com/developers/documentation\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eIf you're interested in testing listings or other shop-related functionality, please put your shop in developer mode: \u003ca href=\"https://www.etsy.com/developers/shop\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.etsy.com/developers/shop\u003c/a\u003e\n​\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eetsypayments.com\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eApplicable to credit card and gift card payments.\u003c/li\u003e\n\u003cli\u003eThis is a secure payment method storage system that interacts with buyer and shop accounts. \u003c/li\u003e\n\u003cli\u003eDocumentation is not provided. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003ehelp.etsy.com\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003ePrimarily interested in findings introduced by Etsy customizations\u003c/li\u003e\n\u003cli\u003eZendesk-wide bugs will be accepted on a case-by-case basis\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTesting Guidelines:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eSet your shop to developer mode here: \u003ca href=\"https://www.etsy.com/developers/shop\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.etsy.com/developers/shop\u003c/a\u003e (after you register an account and complete seller onboarding). Putting your shop in developer mode hides your shop and listings in our search functionality.\u003c/li\u003e\n\u003cli\u003ePlease don't create an excessive number of accounts for testing, and please limit your test transactions to small monetary amounts (like ~$1).\u003c/li\u003e\n\u003cli\u003eIf you'd like to test convos, please use dedicated test accounts only and do not message legitimate members of the site. If testing the listing process, ensure your shop is in developer mode (see above)\u003c/li\u003e\n\u003cli\u003eAvoid using site-wide scanners. Researchers should be using targeted scanning tools as to prevent affecting the production environment. \u003c/li\u003e\n\u003cli\u003eTesting Payments\u003c/li\u003e\n\u003cli\u003eBe mindful with the rate and scope of automated scanning tools. \u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDO NOT\u003c/strong\u003e use automated scanners when testing \u003ca href=\"https://etsypayments.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eetsypayments.com\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAccount Freezes:\u003c/strong\u003e there are situations where during testing your account may be frozen due to fraud protection measures. If this happens, please reach out to the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal.\u003c/a\u003e\u003cbr\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e​------\u003c/p\u003e\n\n\u003ch4\u003eVulnerability Exceptions\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eSecurity reports that don't pertain to etsy.com\u003c/strong\u003e If you're sending in a report for a domain that is not covered in the scope of our bug bounty program, we will ignore it.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eFlaws specific to out of date browsers/plugins.\u003c/strong\u003e Learn more about up-to-date browsers \u003ca href=\"https://www.etsy.com/help/article/5681\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSimple, non-XSS content injection.\u003c/strong\u003e Manipulating a URL to present a page that contains custom text does not qualify for the bug bounty program.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eLogout cross-site request forgery.\u003c/strong\u003e For more information on this issue, please refer to blog posts on the topic by \u003ca href=\"https://scarybeastsecurity.blogspot.com/2010/01/logout-xsrf-significant-web-app-bug.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eChris Evans\u003c/a\u003e and \u003ca href=\"https://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to-design.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eMichal Zalewski\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eLack of the Secure flag on non-sensitive cookies.\u003c/strong\u003e We provide full site SSL as a mechanism to defend against MITM (via HSTS) for sensitive session cookies. More information on this is available here: \u003ca href=\"http://codeascraft.com/2012/10/09/scaling-user-security/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttp://codeascraft.com/2012/10/09/scaling-user-security/\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eLack of HTTPOnly flag on non-sensitive cookies.\u003c/strong\u003e We have set the HTTPOnly flag on cookies we feel are sensitive and we do not consider the lack of HTTPOnly on other cookies to be a vulnerability.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eUsername enumeration through login or password reset.\u003c/strong\u003e While username enumeration can be a vulnerability in a number of web applications, Etsy is a public marketplace and as such usernames can be enumerated by design through a number of ways including listings, forum posts, shops, etc.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCSRF issues\u003c/strong\u003e submitted with a proof-of-concept containing a nonce.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eOut-of-Scope\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eDoS/DDoS\u003c/li\u003e\n\u003cli\u003e3rd party systems and solutions (any resource / service not managed by Etsy). \u003c/li\u003e\n\u003cli\u003eSpam or any other mass distribution to customers, partners, etc. \u003c/li\u003e\n\u003cli\u003ePulling / manipulating any user data or user accounts - during testing, researchers should not pull, change, or erase any customer data during testing. \u003c/li\u003e\n\u003cli\u003eCustomer support channels (chat, phone, email, etc.) - If you have any questions or issues while testing, please send an email to support@bugcrowd.com.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e​\u003cbr\u003e\n\u003cem\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Etsy not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Etsy, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"9df071f7-4e80-43ee-925d-6cd91009909b","name":"In-Scope Targets - Tier 1","targets":[{"id":"15b089dd-626f-4d96-a647-fef0e9146d4c","uri":"https://www.etsy.com","name":"www.etsy.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e89ba322-8ed6-4bc7-8f9d-0f74b4d0a177","sortOrder":0},"sortOrder":0,"tags":[{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"15b089dd-626f-4d96-a647-fef0e9146d4c"},{"id":"866992e9-3297-4b3d-99e3-d74493198f2c","name":"Google Cloud","targetId":"15b089dd-626f-4d96-a647-fef0e9146d4c"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"15b089dd-626f-4d96-a647-fef0e9146d4c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"15b089dd-626f-4d96-a647-fef0e9146d4c"}],"recentChangeFlags":null},{"id":"d60f8ed4-8d80-441c-91b2-a560d55b5be3","uri":"https://www.etsy.com/mobile","name":"Etsy Mobile Application (Android)","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"465040a9-248c-4982-8656-985063d01117","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"d60f8ed4-8d80-441c-91b2-a560d55b5be3"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"d60f8ed4-8d80-441c-91b2-a560d55b5be3"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"d60f8ed4-8d80-441c-91b2-a560d55b5be3"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"d60f8ed4-8d80-441c-91b2-a560d55b5be3"}],"recentChangeFlags":null},{"id":"477bf123-2be6-4e03-acae-3baf7ac6420d","uri":"https://www.etsy.com/mobile","name":"Etsy Mobile Application (iPhone)","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3b99d079-d16e-417d-bfe6-3dfb8e39802f","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"477bf123-2be6-4e03-acae-3baf7ac6420d"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"477bf123-2be6-4e03-acae-3baf7ac6420d"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"477bf123-2be6-4e03-acae-3baf7ac6420d"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"477bf123-2be6-4e03-acae-3baf7ac6420d"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"477bf123-2be6-4e03-acae-3baf7ac6420d"}],"recentChangeFlags":null},{"id":"1d74b161-3539-4070-8459-e2c512e37782","uri":"https://www.etsy.com/developers/documentation/getting_started/api_basics","name":"Etsy API (see documentation below)","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"902a8f81-1448-446f-9b12-07bf25870650","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"1d74b161-3539-4070-8459-e2c512e37782"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"1d74b161-3539-4070-8459-e2c512e37782"}],"recentChangeFlags":null},{"id":"9864c8b9-0910-4620-8e07-9fca33b00a74","uri":"https://etsypayments.com","name":"etsypayments.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6d3a1149-ba5f-4135-b10a-bc2a1b653f11","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"1d1477ab-4b14-4277-8987-90bda79c857e","p1MaxCents":1000000,"p1MinCents":500000,"p2MaxCents":500000,"p2MinCents":100000,"p3MaxCents":80000,"p3MinCents":30000,"p4MaxCents":20000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":5000,"max":10000},"2":{"min":1000,"max":5000},"3":{"min":300,"max":800},"4":{"min":100,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"08760c80-b348-4e69-ad71-7a5a42359e1c","name":"In Scope ","targets":[{"id":"33be80d4-c6ff-4075-bbbe-5946f7ee8657","uri":"https://blog.etsy.com","name":"blog.etsy.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"63290301-da45-4edb-b42f-edba60e92d21","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"33be80d4-c6ff-4075-bbbe-5946f7ee8657"}],"recentChangeFlags":null},{"id":"7c34e4e8-5a31-4a03-afc1-90050b4f39a6","uri":"https://careers.etsy.com","name":"careers.etsy.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3dd992a7-13a1-4a79-ad9c-73716c517900","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7c34e4e8-5a31-4a03-afc1-90050b4f39a6"}],"recentChangeFlags":null},{"id":"851f32fe-bb86-4796-b938-788c0ce37b86","uri":"https://help.etsy.com","name":"help.etsy.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ab271e96-e554-44d2-a166-d99ca39f02fd","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"851f32fe-bb86-4796-b938-788c0ce37b86"}],"recentChangeFlags":null},{"id":"a491d16d-c509-424f-a24e-10e8efedc7e3","uri":"https://community.etsy.com","name":"community.etsy.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6e416685-ea76-4728-b7d7-c62fdb7c61dd","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a491d16d-c509-424f-a24e-10e8efedc7e3"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"b63c050b-db42-4c53-ad31-7d8cfa9a5034","p1MaxCents":250000,"p1MinCents":210000,"p2MaxCents":150000,"p2MinCents":120000,"p3MaxCents":50000,"p3MinCents":30000,"p4MaxCents":15000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eThese targets are backed by third party services. Only bugs that are the result of a misconfiguration on Etsy\u0026#39;s part are in scope.\u003c/p\u003e","rewardRangeData":{"1":{"min":2100,"max":2500},"2":{"min":1200,"max":1500},"3":{"min":300,"max":500},"4":{"min":100,"max":150},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"51266906-2f2e-4cbb-a421-a4e9c57eb4ac","name":"In Scope","targets":[{"id":"adbf15f9-78c2-443a-b707-826e2c2d3ba8","uri":"","name":"*.etsy.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"02cd37f7-27ce-4fee-858f-dc3996dcf90c","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"adbf15f9-78c2-443a-b707-826e2c2d3ba8"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"e21ea675-f2bb-41ab-ac36-840f3e6c190f","p1MaxCents":100000,"p1MinCents":65000,"p2MaxCents":65000,"p2MinCents":45000,"p3MaxCents":45000,"p3MinCents":20000,"p4MaxCents":20000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eFor subdomains hosted by third party services, only misconfigurations on Etsy\u0026#39;s part will be accepted.\u003c/p\u003e","rewardRangeData":{"1":{"min":650,"max":1000},"2":{"min":450,"max":650},"3":{"min":200,"max":450},"4":{"min":50,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"385add47-d205-4909-a577-3ac53b2bfa23","name":"Out of scope","targets":[{"id":"833499cb-4d83-44c6-a4ff-b70a5f913535","uri":null,"name":"icht.etsysecure.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"861b6fa7-b494-4673-827b-414574132d4f","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"833499cb-4d83-44c6-a4ff-b70a5f913535"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"833499cb-4d83-44c6-a4ff-b70a5f913535"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":3,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"572e3bb1-8f49-4b17-9f3f-37e56920349c","code":"etsy","state":"in_progress","endsAt":null,"bountyId":"8c73d476-128b-4561-8e67-1180079ffdec","startsAt":"2018-03-07T19:58:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"eCommerce","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/c678/7530/6cf61d93/9d2b440e8154a57845f9a1337f91d025_etsy_gimp.jpg","logoBackgroundColor":"#e37e40","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2018-03-07T19:58:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/etsy","changelogs":"/engagements/etsy/changelog","submissions":null,"announcements":"/engagements/etsy/announcements","hallOfFame":"/engagements/etsy/hall_of_fames","crowdstream":"/engagements/etsy/crowdstream"},"announcementsCount":7,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/etsy/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=etsy\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/etsy/engagement_subscribers","engagementChangelogsUrl":"/engagements/etsy/changelog","publishedAt":"2026-04-20T21:12:50.730Z","engagementChangelogUrl":"/engagements/etsy/changelog/4ab5bb40-ae5d-41de-a87e-56dfc61a7a11","createUserFeedbacksUrl":"/engagements/etsy/feedbacks","engagementCrowdstreamUrl":"/engagements/etsy/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}