{"id":"a08b91e2-ee0b-4f42-88bf-2de17254d4ea","engagementId":"bafa7937-3358-4c01-b77d-21d003489f8d","data":{"brief":{"id":"65369a6b-9731-46ad-9b09-43c7365cfad1","name":"Flybuys Australia Vulnerability Disclosure Program","tagline":"Flybuys is known for being the country’s most popular rewards program, making the everyday worth more for millions of Aussies. Please submit your findings to this Vulnerability Disclosure Program.","description":"\u003cp\u003eNo technology is perfect and Flybuys believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web and mobile applications. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eProgram Rules\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease provide detailed reports containing all necessary steps to reproduce the issue\u003c/li\u003e\n\u003cli\u003eFlybuys member/customer data is not to be accessed in any way\u003c/li\u003e\n\u003cli\u003eIf you believe you have found sensitive customer or Flybuys data (e.g., login credentials, API keys, etc.) or a way to access customer data (i.e. through a vulnerability) report it, but do not attempt to successfully validate that it works and do not perform post-exploitation\u003c/li\u003e\n\u003cli\u003eYou agree to securely delete any and all data obtained or collected\u003c/li\u003e\n\u003cli\u003eYou make every effort not to damage or restrict the availability of products, services or infrastructure\u003c/li\u003e\n\u003cli\u003eOrdering a physical Flybuys card, redeeming points for rewards or processing payment using a payment gateway are out of scope\u003c/li\u003e\n\u003cli\u003eDenial of Service, Rate Limiting, and other automated attacks are not allowed\u003c/li\u003e\n\u003c/ul\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Flybuys not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Flybuys, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eResearchers are to create an account / self sign up from the Flybuys website https://experience.flybuys.com.au/\u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eAuthentication to the Flybuys website requires an Australian mobile number to create an account.  If you are located in Australia and have access to an Australian mobile number, you may use a single personal Flybuys account when accessing the in-scope endpoints.  \u003c/p\u003e\n\n\u003cp\u003eWhen creating an account, you must use a @bugcrowdninja.com email addresses. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eFlybuys use several third-party providers and services, some which may operate on subdomains of flybuys.com.au – all are considered out of Out-of-Scope for this program. We cannot authorise testing against third-party systems but encourage you to contact those third parties directly if you discover an issue in those services.  \u003c/p\u003e\n\n\u003cp\u003eIf you believe Flybuys has misconfigured or is insecurely using a third-party service and can mitigate the issue by making changes to a Flybuys system, please report the issue.\u003c/p\u003e\n\n\u003cp\u003eThe following activities are prohibited, and out of scope:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePerforming denial-of-service, distributed denial-of-service (DoS and DDoS) or rate-limiting attacks \u003c/li\u003e\n\u003cli\u003eOrdering a physical Flybuys card, redeeming points for rewards or processing payment using a payment gateway \u003c/li\u003e\n\u003cli\u003eUsing stolen or breached user credentials\u003c/li\u003e\n\u003cli\u003eUse of automated scanning tools or scripts \u003c/li\u003e\n\u003cli\u003eAny techniques which may impact the availability or usability of our services \u003c/li\u003e\n\u003cli\u003eAccessing, modifying, deleting or storing Flybuys or customer data \u003c/li\u003e\n\u003cli\u003eConducting post-exploitation activities \u003c/li\u003e\n\u003cli\u003eNon-technical attacks, such as social engineering, phishing and attacks against social media \u003c/li\u003e\n\u003cli\u003eThird-party providers and vendors not operated by Flybuys \u003c/li\u003e\n\u003cli\u003eSubmission forms, contact forms or sending emails to Flybuys \u003c/li\u003e\n\u003cli\u003eConfiguration that is not directly exploitable ie. weak TLS ciphers, password policy, session expiration, certificate pinning, Security headers divulging software version information \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":"\u003cp\u003ePlease provide detailed reports containing all necessary steps to reproduce the issue\u003cbr\u003e\u003cbr\u003e\nFlybuys member/customer data is not to be accessed in any way \u003c/p\u003e\n\n\u003cp\u003eIf you believe you have found sensitive customer or Flybuys data (e.g., login credentials, API keys, etc.) or a way to access customer data (i.e. through\u003cbr\u003e\n a vulnerability) report it, but do not attempt to successfully validate that it works and do not perform post-exploitation.  \u003c/p\u003e\n\n\u003cp\u003eYou agree to securely delete any and all data obtained or collected \u003c/p\u003e\n\n\u003cp\u003e·\u003cbr\u003e\u003cbr\u003e\nYou make every effort not to damage or restrict the availability of products, services or infrastructure. \u003c/p\u003e\n\n\u003cp\u003e·\u003cbr\u003e\u003cbr\u003e\nOrdering a physical Flybuys card, redeeming points for rewards or processing payment using a payment gateway are out of scope \u003c/p\u003e\n\n\u003cp\u003eDenial of Service, Rate Limiting, and other automated attacks are not allowed. \u003c/p\u003e\n\n\u003cp\u003ePlease do NOT use automated tooling. \u003c/p\u003e"},"scope":[{"id":"f2fbb7f9-51e0-4de7-a742-07d51254c0fe","name":"Flybuys - In Scope","targets":[{"id":"fdcf4fa2-2850-4362-8ced-8fbd3ed25ccc","uri":"https://www.flybuystravel.com.au/","name":"flybuystravel.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"26051632-1195-4377-961b-9a00c3209d02","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fdcf4fa2-2850-4362-8ced-8fbd3ed25ccc"}],"recentChangeFlags":null},{"id":"9cea56a6-8db8-49d1-846e-0d4d8b54d58a","uri":"https://play.google.com/store/apps/details?id=com.coles.android.flybuys.release","name":"Flybuys Android app","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2e41148a-0821-4737-a643-b84dd8c26e22","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"9cea56a6-8db8-49d1-846e-0d4d8b54d58a"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"9cea56a6-8db8-49d1-846e-0d4d8b54d58a"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"9cea56a6-8db8-49d1-846e-0d4d8b54d58a"}],"recentChangeFlags":null},{"id":"e464a389-4a48-4fbb-9531-e864970554b2","uri":"https://experience.flybuys.com.au","name":"experience.flybuys.com.au ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"44e88985-aff1-4c5b-82ba-cf823cb5d49d","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"e464a389-4a48-4fbb-9531-e864970554b2"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"e464a389-4a48-4fbb-9531-e864970554b2"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e464a389-4a48-4fbb-9531-e864970554b2"}],"recentChangeFlags":null},{"id":"3a3adf2e-1c6f-46ce-ba5a-d17d0e5a4153","uri":"https://www.flybuys.com.au","name":"flybuys.com.au ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9c4ad8b4-b3e4-40ae-9d56-877e259a00c3","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3a3adf2e-1c6f-46ce-ba5a-d17d0e5a4153"}],"recentChangeFlags":null},{"id":"f6f0e384-fa77-4fe6-ba30-99f479851f1e","uri":"","name":"ahsapi.flybuys.com.au ","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1a80dd1e-f58d-452b-bb02-6cbe997bc88f","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"f6f0e384-fa77-4fe6-ba30-99f479851f1e"}],"recentChangeFlags":null},{"id":"c2fb7b4f-5370-4eaa-b083-e63b171b1123","uri":"","name":"apigw.flybuys.com.au ","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7c290b87-e2a0-4888-9011-9adeed007c5b","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c2fb7b4f-5370-4eaa-b083-e63b171b1123"}],"recentChangeFlags":null},{"id":"5ff1f2eb-1c76-43a7-9f84-aa0eb5e86795","uri":"https://apps.apple.com/au/app/flybuys/id377842707 ","name":"Flybuys iOS app","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7b66d7b0-08e5-4715-8b40-50fd48e6f094","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"5ff1f2eb-1c76-43a7-9f84-aa0eb5e86795"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"5ff1f2eb-1c76-43a7-9f84-aa0eb5e86795"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"5ff1f2eb-1c76-43a7-9f84-aa0eb5e86795"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"5ff1f2eb-1c76-43a7-9f84-aa0eb5e86795"}],"recentChangeFlags":null},{"id":"5d72102a-4557-471f-b9f2-c662aa471118","uri":"https://unpacked.flybuys.com.au/","name":"unpacked.flybuys.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"695776cb-c519-442b-83ef-cebb75ad007b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5d72102a-4557-471f-b9f2-c662aa471118"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003ePlease note: Some Flybuys APIs are geographically restricted. \u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"bafa7937-3358-4c01-b77d-21d003489f8d","code":"flybuys-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"bebd36b2-c037-401b-a9f2-aa18c712cf13","startsAt":"2023-07-18T00:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/3e4b/a7fc/4d64eea0/43197727c886c39f53eca8c3a8b12347_flybuys_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2023-07-18T00:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/flybuys-vdp-pro","changelogs":"/engagements/flybuys-vdp-pro/changelog","submissions":null,"announcements":"/engagements/flybuys-vdp-pro/announcements","hallOfFame":"/engagements/flybuys-vdp-pro/hall_of_fames","crowdstream":"/engagements/flybuys-vdp-pro/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/flybuys-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=flybuys-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/flybuys-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/flybuys-vdp-pro/changelog","publishedAt":"2026-02-16T02:22:54.213Z","engagementChangelogUrl":"/engagements/flybuys-vdp-pro/changelog/a08b91e2-ee0b-4f42-88bf-2de17254d4ea","createUserFeedbacksUrl":"/engagements/flybuys-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/flybuys-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}