{"id":"43036e48-9fc0-4731-9cc9-80e31f4ebd5b","engagementId":"c91c52c6-604d-47f8-baf5-f4edbbbe58b6","data":{"brief":{"id":"95ef2b37-a6d0-4f2f-8ffb-231c48a0a239","name":"Gearset: Managed Bug Bounty","tagline":"Industry-leading DevOps solutions for every Salesforce team","description":"\u003cp\u003eNo technology is perfect and Gearset believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web app. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch1\u003eGearset\u003c/h1\u003e\n\n\u003cp\u003eFor this program, we're inviting researchers to test our Web application and API. Our primary goal is to ensure customer's data is protected and our application is free from security vulnerabilities. \u003c/p\u003e\n\n\u003ch3\u003eRelease frequency\u003c/h3\u003e\n\n\u003cp\u003eGearset regularly releases new code. Our staging environments release changes multiple times per hour, so we would encourage you to regularly visit us. Major functionality will be mentioned in the announcement section, but you can also check the in-app changelog, as well as our \u003ca href=\"https://gearset.com/blog\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eblog\u003c/a\u003e. \u003c/p\u003e\n\n\u003ch4\u003eOut of scope testing:\u003c/h4\u003e\n\n\u003cp\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Gearset not listed in the targets section is out of scope. This includes any/all subdomains not listed.  If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Gearset, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation.\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Gearset not listed in the targets section is out of scope. This includes any/all subdomains not listed above.  IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Gearset, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003ePublic Internet\u003c/p\u003e\n\n\u003ch2\u003eGearset Targets\u003c/h2\u003e\n\n\u003ch3\u003eDocumentation:\u003c/h3\u003e\n\n\u003cp\u003e\u003ca href=\"https://docs.gearset.com/en/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.gearset.com/en/\u003c/a\u003e\u003c/p\u003e\n\n\u003cp\u003eWe recommend you to go through the following docs:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://docs.gearset.com/en/collections/97842-getting-started-with-gearset\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGetting started with Gearset\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://docs.gearset.com/en/articles/2288712-what-is-gearset\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eWhat is Gearset\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://docs.gearset.com/en/articles/2288719-key-features-to-try-out\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eKey Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://docs.gearset.com/en/collections/97763-feature-guides\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFeature guides\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://researcherdocs.bugcrowd.com/v2.0/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. You may register for accounts \u003ca href=\"https://staging.gearset.com/create-account\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003cbr\u003e\nYou will need a developer Salesforce account that can be created \u003ca href=\"https://developer.salesforce.com/signup\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch2\u003eClayton/CodeReviews Targets\u003c/h2\u003e\n\n\u003ch3\u003eDocumentation:\u003c/h3\u003e\n\n\u003cp\u003e\u003ca href=\"https://docs.gearset.com/en/collections/13062331-code-reviews\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.gearset.com/en/collections/13062331-code-reviews\u003c/a\u003e\u003c/p\u003e\n\n\u003cp\u003eWe recommend you go through the following docs:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://docs.gearset.com/en/collections/10927409-getting-started-with-code-reviews\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGetting started with Code Reviews\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://docs.gearset.com/en/collections/13304453-launch-your-first-code-review\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLaunch your first code review\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://docs.gearset.com/en/collections/13062409-code-reviews-integrations\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCode Reviews integrations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://docs.gearset.com/en/articles/11668029-understanding-user-roles-in-code-reviews-account-level-and-project-level\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eUnderstanding user roles\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://staging.claytonapp.com/swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAPI Swagger documentation\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eResearchers should only use our staging environment. Our production environment is not to be used.\u003c/p\u003e\n\n\u003cp\u003ePlease do not use:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThird party domains including any Salesforce domains\u003c/li\u003e\n\u003cli\u003eThird party chat widget (sales \u0026amp; support)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eOur marketing site (gearset.com) is also out of scope.\u003c/p\u003e\n\n\u003ch3\u003eKnown Items\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eExposed Raygun API keys - We have implemented as per the documentation for client JS applications and thus standalone submissions stating it is exposed in the client are out of scope.\u003c/li\u003e\n\u003cli\u003eSome features intentionally make server-side requests to user-supplied URLs. Demonstrating as a standalone issue that we fetch an external, publicly accessible and attacker-controlled URL without any further impact will be considered out of scope.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"88b329fa-0a7b-478d-9c80-6e7dcd76b0cf","name":"Gearset Staging","targets":[{"id":"a28a0e9c-3050-43ba-972a-f35f5a7c2984","uri":"https://staging.gearset.com/","name":"*.staging.gearset.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cd922be5-db33-46c9-be3d-6cea74bd8fb5","sortOrder":0},"sortOrder":0,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"a28a0e9c-3050-43ba-972a-f35f5a7c2984"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"a28a0e9c-3050-43ba-972a-f35f5a7c2984"},{"id":"6155adbb-bc15-4203-8b79-bd7a589ae5b4","name":"Redux","targetId":"a28a0e9c-3050-43ba-972a-f35f5a7c2984"},{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"a28a0e9c-3050-43ba-972a-f35f5a7c2984"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"a28a0e9c-3050-43ba-972a-f35f5a7c2984"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"a28a0e9c-3050-43ba-972a-f35f5a7c2984"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"a28a0e9c-3050-43ba-972a-f35f5a7c2984"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"a28a0e9c-3050-43ba-972a-f35f5a7c2984"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"a28a0e9c-3050-43ba-972a-f35f5a7c2984"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"4c72c154-5abe-400d-8e7a-10ccbe9f325e","p1MaxCents":600000,"p1MinCents":500000,"p2MaxCents":400000,"p2MinCents":150000,"p3MaxCents":85000,"p3MinCents":60000,"p4MaxCents":25000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch3\u003eTech stack:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eTypescript, React, Redux\u003c/li\u003e\n\u003cli\u003e.NET 10, ASP.NET\u003c/li\u003e\n\u003cli\u003ePostgres RDS\u003c/li\u003e\n\u003cli\u003eKubernetes\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eFocus areas:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eGearset agent (\u003ca href=\"https://docs.gearset.com/en/articles/16119008-working-with-the-gearset-agent\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e) - AI agent controlled with free form prompt to build changes in git ready for a Salesforce org\n\n\u003cul\u003e\n\u003cli\u003eIf you require access please reach out to bugcrowd@gearset.com so we can get you set up\u003c/li\u003e\n\u003cli\u003eYou’ll need to have set up a pipeline to get started (\u003ca href=\"https://docs.gearset.com/en/articles/10963175-creating-your-first-pipeline-using-the-setup-wizard\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eWe won’t reward for reports getting the agent to divulge details about its environment\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003cli\u003eAI powered UI testing tool (\u003ca href=\"https://docs.gearset.com/en/articles/12960167-introduction-to-automated-ui-testing\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e) - a tool to drive browser based testing of a Salesforce org, AI prompts used to generate steps\u003c/li\u003e\n\u003cli\u003eOrg Intelligence (\u003ca href=\"https://docs.gearset.com/en/articles/11831993-org-intelligence\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e) - a tool to explore the configuration of a Salesforce org and understand how it is set up\u003c/li\u003e\n\u003cli\u003eCross team vulnerabilities - a customer on team A should not be able to read data about a customer on team B\u003c/li\u003e\n\u003cli\u003eXML and user controlled code - we handle large amounts of XML and git repositories in different and interesting ways\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":5000,"max":6000},"2":{"min":1500,"max":4000},"3":{"min":600,"max":850},"4":{"min":200,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"848b777d-0a7b-449f-ad63-e7d07c76b0c0","name":"Gearset Public API","targets":[{"id":"99e84d23-1399-433b-a7da-7fb74827f41e","uri":"https://staging.gearset.com/","name":"staging-api.gearset.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"77e895f9-0348-4d68-af2b-d3dc1c6ed097","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"99e84d23-1399-433b-a7da-7fb74827f41e"},{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"99e84d23-1399-433b-a7da-7fb74827f41e"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"99e84d23-1399-433b-a7da-7fb74827f41e"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"4c72c154-5abe-400d-8e7a-10ccbe9f325e","p1MaxCents":600000,"p1MinCents":500000,"p2MaxCents":400000,"p2MinCents":150000,"p3MaxCents":85000,"p3MinCents":60000,"p4MaxCents":25000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eGetting started\u003c/h2\u003e\n\n\u003cp\u003eWe provide a getting started guide for our customers, which explains how to create access tokens and make your first request. This can be found \u003ca href=\"https://docs.gearset.com/en/articles/6099550-getting-started-with-the-gearset-api\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. \u003c/p\u003e\n\n\u003cp\u003eThe only difference to the above is that you should be using \u003cstrong\u003ehttps://staging-api.gearset.com\u003c/strong\u003e rather than https://staging.gearset.com to make API request, and you should be logging in our \u003ca href=\"https://staging.gearset.com/configure\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003etest instance\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch2\u003eDocs\u003c/h2\u003e\n\n\u003cp\u003eFor more information, please view our \u003ca href=\"https://staging-api.gearset.com/public/automation/docs/index.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAPI docs\u003c/a\u003e.\u003cbr\u003e\nThese contain curl commands which you can use to send requests to our API.\u003c/p\u003e","rewardRangeData":{"1":{"min":5000,"max":6000},"2":{"min":1500,"max":4000},"3":{"min":600,"max":850},"4":{"min":200,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"447acb12-f6e5-4594-ae9d-98b150f34f45","name":"HIPAA Gearset Staging","targets":[{"id":"887befe3-b926-48a5-a6bb-b80784f81edc","uri":"https://hipaa.staging.gearset.com/","name":"hipaa.staging.gearset.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f2c6a664-f064-4c8a-bf2b-6c77f92c4ff0","sortOrder":0},"sortOrder":0,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"887befe3-b926-48a5-a6bb-b80784f81edc"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"887befe3-b926-48a5-a6bb-b80784f81edc"},{"id":"6155adbb-bc15-4203-8b79-bd7a589ae5b4","name":"Redux","targetId":"887befe3-b926-48a5-a6bb-b80784f81edc"},{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"887befe3-b926-48a5-a6bb-b80784f81edc"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"887befe3-b926-48a5-a6bb-b80784f81edc"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"887befe3-b926-48a5-a6bb-b80784f81edc"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"887befe3-b926-48a5-a6bb-b80784f81edc"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"887befe3-b926-48a5-a6bb-b80784f81edc"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"887befe3-b926-48a5-a6bb-b80784f81edc"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"4c72c154-5abe-400d-8e7a-10ccbe9f325e","p1MaxCents":600000,"p1MinCents":500000,"p2MaxCents":400000,"p2MinCents":150000,"p3MaxCents":85000,"p3MinCents":60000,"p4MaxCents":25000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch3\u003eSummary:\u003c/h3\u003e\n\n\u003cp\u003eThe same API as Gearset Staging.\u003cbr\u003e\nCustomer accounts must be added manually by Gearset and researchers \u003cstrong\u003ewill not\u003c/strong\u003e be given accounts, so should not be able to access any meaningful data or make any changes on this system.\u003c/p\u003e","rewardRangeData":{"1":{"min":5000,"max":6000},"2":{"min":1500,"max":4000},"3":{"min":600,"max":850},"4":{"min":200,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"3af65971-b670-4fc0-a918-4c39fbd490e6","name":"Clayton Staging","targets":[{"id":"9dc798b3-4bd1-4e41-9013-3b7710c059aa","uri":"https://staging.claytonapp.com","name":"staging.claytonapp.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"93504c82-0768-4209-8ad2-82cd620b892c","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"9dc798b3-4bd1-4e41-9013-3b7710c059aa"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"9dc798b3-4bd1-4e41-9013-3b7710c059aa"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"9dc798b3-4bd1-4e41-9013-3b7710c059aa"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"9dc798b3-4bd1-4e41-9013-3b7710c059aa"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":{"id":"4c72c154-5abe-400d-8e7a-10ccbe9f325e","p1MaxCents":600000,"p1MinCents":500000,"p2MaxCents":400000,"p2MinCents":150000,"p3MaxCents":85000,"p3MinCents":60000,"p4MaxCents":25000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003e\u003cstrong\u003eTech stack:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eJava 21 (Amazon Corretto), Spring Boot, Spring Security\u003c/li\u003e\n\u003cli\u003ePostgres (RDS), Hibernate/JPA\u003c/li\u003e\n\u003cli\u003eOpenSearch\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eFocus area:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthentication \u0026amp; SSO (\u003ca href=\"https://docs.gearset.com/en/articles/11478684-sso-saml-support-in-code-reviews\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e) - OAuth2, SAML2 SSO flows, MFA, session management, API key auth\u003c/li\u003e\n\u003cli\u003eMulti-tenancy \u0026amp; data isolation - Customer on Workspace A should not be able to read/modify data belonging to another customer on Workspace B\u003c/li\u003e\n\u003cli\u003eVCS connections (\u003ca href=\"https://docs.gearset.com/en/articles/11478833-code-reviews-connections\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e) - GitHub, GitLab, Bitbucket, Azure DevOps connection management and token handling\u003c/li\u003e\n\u003cli\u003ePolicy \u0026amp; rule management (\u003ca href=\"https://docs.gearset.com/en/articles/11478932-code-reviews-policies-explained\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e) - Custom policy CRUD, versioning, attachment to projects\u003c/li\u003e\n\u003cli\u003ePull request scanning (\u003ca href=\"https://docs.gearset.com/en/articles/11478928-trigger-your-first-code-reviews-scan\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e) - Scan operations, quality gates, webhook-triggered scans\u003c/li\u003e\n\u003cli\u003eWebhooks (\u003ca href=\"https://docs.gearset.com/en/articles/11478745-creating-webhooks-in-code-reviews\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e)\n\n\u003cul\u003e\n\u003cli\u003eInbound webhooks from VCS platforms—signature validation, event injection\u003c/li\u003e\n\u003cli\u003eOutbound webhooks—SSRF, data leakage\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003cli\u003eUser roles \u0026amp; permissions (\u003ca href=\"https://docs.gearset.com/en/articles/11668029-understanding-user-roles-in-code-reviews-account-level-and-project-level\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edocs\u003c/a\u003e) - Account-level and project-level role enforcement, privilege escalation\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":5000,"max":6000},"2":{"min":1500,"max":4000},"3":{"min":600,"max":850},"4":{"min":200,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"3f89fdfd-0474-45f9-9453-7373c8027d9a","name":"Clayton Public API","targets":[{"id":"89462e81-4060-4290-b604-5e8b37a4fcb9","uri":"https://staging.claytonapp.com/api","name":"staging.claytonapp.com/api","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"751344c0-61cb-46ff-9e12-1b0fd7abb2eb","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"89462e81-4060-4290-b604-5e8b37a4fcb9"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"89462e81-4060-4290-b604-5e8b37a4fcb9"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"89462e81-4060-4290-b604-5e8b37a4fcb9"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":4,"description":null,"rewardRange":{"id":"4c72c154-5abe-400d-8e7a-10ccbe9f325e","p1MaxCents":600000,"p1MinCents":500000,"p2MaxCents":400000,"p2MinCents":150000,"p3MaxCents":85000,"p3MinCents":60000,"p4MaxCents":25000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003e\u003cstrong\u003eGetting started\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eWe provide documentation on how to invoke Code Reviews APIs using OAuth2 \u003ca href=\"https://docs.gearset.com/en/articles/11478711-invoke-code-reviews-apis-using-oauth2\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. Use \u003ccode\u003estaging.claytonapp.com\u003c/code\u003e rather than the production API endpoint. Generate API credentials from your \u003ca href=\"https://staging.claytonapp.com/configure\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003estaging workspace settings\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eDocs\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eFor more information, view our \u003ca href=\"https://staging.claytonapp.com/swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAPI docs\u003c/a\u003e. These contain endpoint definitions you can use to test the API directly.\u003c/p\u003e","rewardRangeData":{"1":{"min":5000,"max":6000},"2":{"min":1500,"max":4000},"3":{"min":600,"max":850},"4":{"min":200,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"119ea8db-f34b-4fc2-b93d-98584ee9963a","name":"Out of scope targets","targets":[{"id":"88915a3d-22a0-401b-aeeb-77586fe449e6","uri":"","name":"api.gearset.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ad0925a6-4652-47db-9269-5225fd23931c","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"dbfabae8-7a7d-4c00-ad93-70adba25e377","uri":"","name":"app.gearset.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8c697b57-2d63-4ed3-be08-3335a22dd988","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"862971dd-51f3-4722-bc61-d8dfdb133504","uri":"","name":"us.app.gearset.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"809ff9cf-6c5f-4312-92de-88fed469b380","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"2c4ccd29-d766-44f0-a330-95b47c4e412b","uri":"","name":"eu.app.gearset.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"98fa6a4d-b731-4806-9a31-2fb712ca8d03","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e1143a12-29af-44d6-b2dd-65ccaa3d7a82","uri":"","name":"ap.app.gearest.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"059fbb97-daed-45c7-87e2-202fa3eee4ba","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"140dbabb-30a8-49d7-ba2b-0a8dcb1423b3","uri":"","name":"gearset.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"750b4689-2869-4aa5-96d1-524ebabc617f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e20158e2-0c89-43e7-a2fc-190752a8be86","uri":"","name":"app.clayton.io","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3aa74507-f1b4-407e-b6dc-bcdb09389c3f","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"0a2dff66-ade5-4e5e-9a19-11b2d42eb19e","uri":"","name":"getclayton.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cb4165e0-fa93-433f-b21f-2200712668e3","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null},{"id":"26220830-200d-4e58-ae4b-435fe749952b","uri":"","name":"api.clayton.io","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1cd04dde-b7f7-4d79-bb39-1b977659733e","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":5,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eResearchers should only use our staging environment. Our production environment is \u003cstrong\u003enot\u003c/strong\u003e to be used. \u003c/p\u003e\n\n\u003cp\u003eAny domain/property of Gearset not listed in the targets section is out of scope (this includes our marketing website gearset.com). This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Gearset, it may be reported to this program, and is appreciated - but will ultimately be marked as \u0026#39;not applicable\u0026#39; and will not be eligible for monetary or points-based compensation.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"c91c52c6-604d-47f8-baf5-f4edbbbe58b6","code":"gearset-mbb","state":"in_progress","endsAt":null,"bountyId":"15fdb3da-5047-4576-80d2-3bb9d5e8282f","startsAt":"2021-02-02T12:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/d645/d69d/e2c39c06/c937316c731a441b12b3e7f2fbcc096f_Gearset_mark_rgb.png","logoBackgroundColor":"#FFFFFF","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2021-02-02T12:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/gearset-mbb","changelogs":"/engagements/gearset-mbb/changelog","submissions":null,"announcements":"/engagements/gearset-mbb/announcements","hallOfFame":"/engagements/gearset-mbb/hall_of_fames","crowdstream":"/engagements/gearset-mbb/crowdstream"},"announcementsCount":10,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/gearset-mbb/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=gearset-mbb\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/gearset-mbb/engagement_subscribers","engagementChangelogsUrl":"/engagements/gearset-mbb/changelog","publishedAt":"2026-08-26T14:31:25.204Z","engagementChangelogUrl":"/engagements/gearset-mbb/changelog/43036e48-9fc0-4731-9cc9-80e31f4ebd5b","createUserFeedbacksUrl":"/engagements/gearset-mbb/feedbacks","engagementCrowdstreamUrl":"/engagements/gearset-mbb/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}