{"id":"f2e7ea74-4b97-483d-9a51-d0da7e7f4b11","engagementId":"d817dc19-4e9f-4ba6-a3ca-5dd4e0b1898a","data":{"brief":{"id":"96c825b6-6d31-4598-9c66-e830135eb532","name":"Glassdoor Managed Bug Bounty Engagement","tagline":"Find the right job for you, fast.","description":"\u003cp\u003eAt Glassdoor we take our security very seriously and welcome any responsible disclosure of potential gaps in our systems. We believe that working with skilled security researchers across the globe is crucial in providing a trusted and secure service to help people everywhere find jobs and companies they love.Please read through the following details to help you focus on the areas most important to us.\u003c/p\u003e\n\n\u003cp\u003eAdditionally, Glassdoor may award an additional reward bonus for exceptional reports. This will be done at Glassdoor's discretion. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eEngagement Rules\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eRespect our users' privacy\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eIf during your research you happen to encounter any information about another user or other individual, immediately stop and report this to Glassdoor. To participate in this program, you only need to explain the technical vulnerability you discovered\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou must avoid any viewing, copying, altering, destroying, or otherwise interacting with any data, in particular data of other individuals, to which you may gain access through your research. If a vulnerability provides unintended access to data, limit the amount of data you access to the minimum required for effectively demonstrating the vulnerability; cease testing, and submit a report immediately if you encounter any user data during testing. This may include Personally Identifiable Information (PII), Diversity and Inclusion data, or Proprietary Information.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eLeave the Site as you found it\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eDo not copy, save, store, transfer, disclose, or otherwise retain any information you find on our site during your research, except to report your research to Glassdoor.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eDon't violate our Terms of Service or the law\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eAll access to our Site must otherwise be in accordance with our Terms of Service and all applicable laws\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIn the event you access PII or other sensitive data, note that you are required to follow all laws and regulations applicable to the access and processing of such personally identifiable information and/or data, such as the California Consumer Privacy Act of 2018, the California Privacy Rights Act of 2020, New York Privacy Act 2021, once they become effective, and the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679), including the European Commission’s Standard Contractual Clauses regarding the transfer of personal data to processors\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eDon't impact our services\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eYou must avoid causing any interruption or degradation of our services. Researchers who are found to be using aggressive automated tools will be reported to Bugcrowd for non co-operation.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNo interacting with others\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eAny form of interaction with others on or through our Site, including but not limited to other Glassdoor users, is strictly prohibited. Do not make any attempts to phish users or employees.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eCooperate with Glassdoor\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eYou will be expected to cooperate with us if we request your assistance in connection with your research.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/p\u003e","industryTagId":"948573e8-bbbb-4552-918a-f87250ebe1fc","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Glassdoor not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Glassdoor, you can report it to to this engagement. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eParticipation Eligibility\u003c/h2\u003e\n\n\u003cp\u003eCurrent employees or contractors of Glassdoor are not eligible to participate in the program. Former employees and contractors are eligible to participate in the program only, if:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThey have left Glassdoor more than 1 year prior to submission, and\u003c/li\u003e\n\u003cli\u003eThey are not making use of, or referring to, any non-public Glassdoor information obtained when they were an employee or contractor\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eEngagement Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003ePlease do not perform any testing on live bowls or real company pages. All testing must happen in our approved Bugcrowd bowl (or private test bowls you create) or the \u003ca href=\"https://www.glassdoor.ca/Overview/Working-at-Acme-Corp-EI_IE4708436.11,20.htm?countryRedirect=true\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAcme\u003c/a\u003e/\u003ca href=\"https://www.glassdoor.ca/Overview/Working-at-Winkler-Web-Designs-EI_IE1901640.11,30.htm?countryRedirect=true\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eWinkler Web Design\u003c/a\u003e company pages. Failure to comply may result in disqualification from our program\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ePotential post-exploitation scenarios: If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding. We will work with you to evaluate the vulnerability and award you accordingly for the final impact and severity\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eYou are testing on production. Behavior that compromises the stability and integrity of the target(s) is out of scope\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e For example, do not target other users' data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. \u003cstrong\u003eIf you believe that you have found a vulnerability of this nature, please stop further testing and report it\u003c/strong\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ePII Data in our platform refers to data that readily identifies an individual on the face of the data (e.g. a name, email address, phone number, national ID number, etc.) If the data exposed includes this type of data, all the data exposed with it is also considered PII. However, if facially identifiable data is not present in the exposure (i.e. it is not possible for a third-party to identify who the data belongs to) then the exposed data does not constitute PII as exposed (even if it would constitute PII within Glassdoor’s systems because it is normally connected to facially identifiable data)\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eLocalization: Glassdoor is an international company with many different subdomains for different countries, running the same applications in different languages. Localized versions can share the same codebase and therefore, a vulnerability found on many may only be eligible to be rewarded once\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eThird party applications: For third party applications, such as Wordpress or Salesforce, will only be eligible for reward if there is a reasonable action Glassdoor can take to mitigate issues identified. A good example of something we wouldn't payout for is the output of WPScan showing recently out of date plugins, since regular patching is part of our WP management. An example of something we would payout for is a POC showing unintended behavior that isn't in a vendor patch, which is in our ability to fix\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDisclosing results: This bounty requires explicit permission to disclose the results of a submission\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eReport Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eReports must contain a clear explanation of the issue and the security impact along with detailed steps to reproduce it. If the issue cannot be reliably reproduced based on your report, it may be considered ineligible for a reward\u003c/li\u003e\n\u003cli\u003ePlease include a video PoC for exploits that are more complicated in nature\u003c/li\u003e\n\u003cli\u003eDo not submit more than one vulnerability per report. In cases where demonstrating impact requires chaining multiple vulnerabilities together, those can be included in the same report as long as the linkage is clearly explained\u003c/li\u003e\n\u003cli\u003eWe do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human input will be rejected\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eAll applications within scope are publicly accessible\u003c/p\u003e\n\n\u003ch2\u003eCredentials\u003c/h2\u003e\n\n\u003cp\u003eTo register on Glassdoor or Fishbowl, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eAdditional account can be created using an alias of your @bugcrowdninja email address.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eAccounts Types and Roles:\u003c/strong\u003e \u003c/p\u003e\n\n\u003cp\u003eGeneral User: Typical user access\u003cbr\u003e\nEmployer User: Glassdoor \u003ca href=\"https://www.glassdoor.com/employers/resources/glassdoor-employer-center-guide/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eEmployee Center Guide\u003c/a\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eTesting Glassdoor Payloads:\u003c/strong\u003e\u003cbr\u003e\nUse our test companies Acme Corp and/or Winkler Web Designs - please DO NOT test against other companies which you don't have explicit permission to.\u003c/p\u003e\n\n\u003cp\u003eTo get invited to both or either of the companies fill out the following \u003ca href=\"https://docs.google.com/forms/d/e/1FAIpQLSdg7grIqhZIDaRLdRC5WSE4bU8mlcTFS425ZSHYAK3n9vgkNA/viewform\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGoogle Form\u003c/a\u003e and we will do our best to invite you as soon as possible\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eTesting Fishbowl Payloads:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eTo register on Fishbowl please sign up for an account using your @bugcrowdninja.com email address. In doing so you will be automatically included in the company bowl \"Bugcrowdninja\". \u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eNote: Reports submitted using accounts other than @bugcrowdninja will not be eligible for a reward\u003c/em\u003e\u003c/strong\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eVulnerability Exceptions\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003e\u003cstrong\u003eSome types of issues do not present a significant enough risk to Glassdoor, and are usually not accepted.\u003c/strong\u003e\u003c/em\u003e\u003cbr\u003e\nAny submission of these types will only be rewardable if significant risk and impact can be demonstrated.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eIntra-Organizational Broken Access Controls, unless integrity impact is high\u003c/li\u003e\n\u003cli\u003eVulnerabilities dependent on unlikely high privileges (eg. malicious admin)\u003c/li\u003e\n\u003cli\u003eUser enumeration vulnerabilities\u003c/li\u003e\n\u003cli\u003eVolumetric DoS vulnerabilities\u003c/li\u003e\n\u003cli\u003eDebug/Stack trace/Errors with non-secret data\u003c/li\u003e\n\u003cli\u003eRate-limiting vulnerabilities, unless integrity impact is high\u003c/li\u003e\n\u003cli\u003eExternal SSRF\u003c/li\u003e\n\u003cli\u003eInternal SSRF without an impactful proof of concept\u003c/li\u003e\n\u003cli\u003eHTMLi without a realistic and impactful proof of concept\u003c/li\u003e\n\u003cli\u003eSelf-XSS\n​​- Clickjacking on pages with no sensitive data or actions\u003c/li\u003e\n\u003cli\u003eAttacks requiring Man-in-the-Middle or physical access to a user’s device\u003c/li\u003e\n\u003cli\u003eWAF-bypass via Origin IP\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting users of outdated browsers\u003c/li\u003e\n\u003cli\u003eSPF/DMARC/DKIM record missing on a domain\u003c/li\u003e\n\u003cli\u003eSSTI, without impactful proof of concept\u003c/li\u003e\n\u003cli\u003ePublic API schema\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eP5 vulnerabilities\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvailability/volumetric testing e.g.:\n\n\u003cul\u003e\n\u003cli\u003eDoS/DDoS/Network DoS\u003c/li\u003e\n\u003cli\u003eRate limiting bypass attempts\u003c/li\u003e\n\u003cli\u003eEmail bombing or flooding\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eALL forms of social Engineering\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eLegal Terms:\u003c/h2\u003e\n\n\u003cp\u003eBy participating in Glassdoor’s Bug Bounty program (the “Program”), you acknowledge that you have read and agree to Glassdoor’s Terms of Use as well as the following:\u003cbr\u003e\nYour participation in the Program will not violate any law applicable to you, or disrupt or compromise any data that is not your own.\u003cbr\u003e\nYou agree that any and all information acquired or accessed by you while participating in the program is confidential to Glassdoor and you shall hold the confidential information in strict confidence and shall not copy, reproduce, sell, assign, license, market, transfer, or otherwise dispose of, give or disclose such information to third parties or use such information for any purposes other than for the performance of your work under the Program.\u003c/p\u003e\n\n\u003cp\u003eYou acknowledge and agree that any and all information you encounter is owned by Glassdoor or its third-party providers, users, or customers. You have no rights, title, or ownership to any information that you may encounter.\u003c/p\u003e\n\n\u003cp\u003eAny activities conducted in a manner consistent with these terms and the Program will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under these terms and the Program, we may take steps to make it known that your actions were conducted in compliance with the terms and the Program, in our sole discretion. Glassdoor cannot authorize any activity on third-party products or guarantee they won’t pursue legal action against you. We aren’t responsible for your liability for actions performed on third parties.\u003c/p\u003e\n\n\u003cp\u003eThis is not a competition, but rather a discretionary rewards program. The decision to pay or not pay a reward is in our sole discretion.\u003cbr\u003e\nWe are unable to issue rewards to individuals who are on sanctions lists, or who are in countries (e.g., Cuba, Iran, North Korea, Syria, Crimea, and the so-called Donetsk People's Republic and Luhansk People's Republic) on sanctions lists. You are responsible for any tax implications depending on your country of residency and citizenship. There may be additional restrictions on your ability to enter depending upon your local law.\u003c/p\u003e\n\n\u003cp\u003eYou are solely responsible for any applicable taxes and/or withholdings, arising from or relating to your participation in the Program, including from any bounty payments.\u003c/p\u003e\n\n\u003cp\u003eWe reserve the right to terminate or discontinue the Program at any time, in our sole discretion.\u003c/p\u003e\n\n\u003cp\u003eThank you for helping keep Glassdoor and our users safe!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our \u003ca href=\"https://www.bugcrowd.com/resources/hacker-resources/standard-disclosure-terms/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTerms \u0026amp; Conditions\u003c/a\u003e  that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via our \u003ca href=\"https://bugcrowd-support.freshdesk.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFreshdesk Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"02ff8ec4-1066-4adf-a106-db3cf7f98318","name":"In Scope ","targets":[{"id":"35b3aec7-3ff7-4e70-afaf-0963437fd52d","uri":"","name":"https://api.glassdoor.com/*","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"709128de-028f-4620-a963-92486e7381cd","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"35b3aec7-3ff7-4e70-afaf-0963437fd52d"}],"recentChangeFlags":null},{"id":"216cbc52-9b46-411d-892b-068968d683bd","uri":"","name":"https://www.glassdoor.com/*","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"12c44ff5-a1af-431c-9dbe-62b2185ff9ec","sortOrder":1},"sortOrder":1,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"216cbc52-9b46-411d-892b-068968d683bd"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"216cbc52-9b46-411d-892b-068968d683bd"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"216cbc52-9b46-411d-892b-068968d683bd"}],"recentChangeFlags":null},{"id":"30afa4c0-fcd3-4fc7-9443-71d771857cb1","uri":"","name":"https://www.glassdoor.com/member/*","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"91fb3336-cefe-45a2-a35b-91921ceee88d","sortOrder":2},"sortOrder":2,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"30afa4c0-fcd3-4fc7-9443-71d771857cb1"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"30afa4c0-fcd3-4fc7-9443-71d771857cb1"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"30afa4c0-fcd3-4fc7-9443-71d771857cb1"}],"recentChangeFlags":null},{"id":"8725868f-0a57-4a28-b101-62c6d3863136","uri":"","name":"https://www.glassdoor.com/employers/ec/*","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e51cd4f0-75ff-4311-9b34-e326106ac466","sortOrder":3},"sortOrder":3,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"8725868f-0a57-4a28-b101-62c6d3863136"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"8725868f-0a57-4a28-b101-62c6d3863136"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"8725868f-0a57-4a28-b101-62c6d3863136"}],"recentChangeFlags":null},{"id":"2668603f-e11b-42ab-bcbe-ae1c29934a6c","uri":"","name":"https://www.glassdoor.com/Job/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d3bb19ea-05fc-4899-8c8c-fedf8457bc63","sortOrder":5},"sortOrder":5,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"2668603f-e11b-42ab-bcbe-ae1c29934a6c"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"2668603f-e11b-42ab-bcbe-ae1c29934a6c"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"2668603f-e11b-42ab-bcbe-ae1c29934a6c"}],"recentChangeFlags":null},{"id":"f6f9e564-4601-43cd-9f38-51f4128f7210","uri":"","name":"https://www.glassdoor.com/Reviews/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a65b01bb-0689-4d95-ada6-b45621988d8b","sortOrder":6},"sortOrder":6,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"f6f9e564-4601-43cd-9f38-51f4128f7210"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"f6f9e564-4601-43cd-9f38-51f4128f7210"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"f6f9e564-4601-43cd-9f38-51f4128f7210"}],"recentChangeFlags":null},{"id":"255a41a9-ece0-4371-9b92-46fd278a8895","uri":"","name":"https://www.glassdoor.com/Compare/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"68800792-3afe-471b-bc24-3004f50a564b","sortOrder":7},"sortOrder":7,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"255a41a9-ece0-4371-9b92-46fd278a8895"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"255a41a9-ece0-4371-9b92-46fd278a8895"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"255a41a9-ece0-4371-9b92-46fd278a8895"}],"recentChangeFlags":null},{"id":"0c65bd01-abb7-4343-9889-236c25ddcb47","uri":"","name":"https://www.glassdoor.com/mz-survey/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d5415a1d-a01a-43c6-9d61-062196ba2457","sortOrder":8},"sortOrder":8,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"0c65bd01-abb7-4343-9889-236c25ddcb47"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"0c65bd01-abb7-4343-9889-236c25ddcb47"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"0c65bd01-abb7-4343-9889-236c25ddcb47"}],"recentChangeFlags":null},{"id":"24a8aa0e-046c-4419-b305-6343b0b0d468","uri":"","name":"https://www.glassdoor.com/Salaries/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6544edf9-2690-4704-8ee6-2ea5541894de","sortOrder":9},"sortOrder":9,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"24a8aa0e-046c-4419-b305-6343b0b0d468"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"24a8aa0e-046c-4419-b305-6343b0b0d468"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"24a8aa0e-046c-4419-b305-6343b0b0d468"}],"recentChangeFlags":null},{"id":"ab038f71-5eb1-4fc6-8d2a-978b0fe59c57","uri":"https://www.fishbowlapp.com/","name":"Fishbowl","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e5a62f84-e159-4bc8-978d-75059532a466","sortOrder":10},"sortOrder":10,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ab038f71-5eb1-4fc6-8d2a-978b0fe59c57"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"ab038f71-5eb1-4fc6-8d2a-978b0fe59c57"}],"recentChangeFlags":null},{"id":"b6a60924-4dd2-4975-adb8-d9e47346a43c","uri":"","name":"https://api.fishbowlapp.com/*","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"18bbf1f5-5f96-4eb7-8831-3ca7c10d145b","sortOrder":11},"sortOrder":11,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"b6a60924-4dd2-4975-adb8-d9e47346a43c"}],"recentChangeFlags":null},{"id":"4b41677a-9413-4816-b43a-fe4f89b06582","uri":"https://play.google.com/store/apps/details?id=com.fishbowlmedia.fishbowl\u0026hl=en_US","name":"Fishbowl - Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a115bddf-48dd-4a36-ab82-4f75025af636","sortOrder":12},"sortOrder":12,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"4b41677a-9413-4816-b43a-fe4f89b06582"}],"recentChangeFlags":null},{"id":"d0b6e695-ce44-4dda-a0ee-e93c0b3b5832","uri":"https://apps.apple.com/us/app/fishbowl-professional-network/id1005070636","name":"Fishbowl - iOS ","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3be88e6d-75a6-4e23-b663-304b69d2e997","sortOrder":13},"sortOrder":13,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"d0b6e695-ce44-4dda-a0ee-e93c0b3b5832"}],"recentChangeFlags":null},{"id":"ea771b8e-09d0-421e-a850-f2bd2823123a","uri":"https://apps.apple.com/us/app/glassdoor-jobs-careers/id589698942","name":"Glassdoor iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3e3f4ffe-bc79-4ec9-bb01-7862dc6508cc","sortOrder":14},"sortOrder":14,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"ea771b8e-09d0-421e-a850-f2bd2823123a"}],"recentChangeFlags":null},{"id":"efc1cec8-a0e0-4f96-b075-c06ab2d7af98","uri":"https://play.google.com/store/apps/details?id=com.glassdoor.app\u0026hl=en_US","name":"Glassdoor Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4ec8d2a4-89cf-407e-af59-77d2cb26a69d","sortOrder":15},"sortOrder":15,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"efc1cec8-a0e0-4f96-b075-c06ab2d7af98"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"e6f20039-8825-49f7-b4a9-e914c432f1f1","p1MaxCents":700000,"p1MinCents":350000,"p2MaxCents":300000,"p2MinCents":100000,"p3MaxCents":75000,"p3MinCents":30000,"p4MaxCents":10000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eTarget Information\u003c/h2\u003e\n\n\u003ctable\u003e\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eURL\u003c/th\u003e\n\u003cth\u003eDescription\u003c/th\u003e\n\u003cth\u003eFocus Area(s)\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://api.glassdoor.com/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eGlassdoor\u0026#39;s API endpoint formatted in XML or JSON. \u003ca href=\"https://www.glassdoor.com/developer/index.htm\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eDeveloper Documentation\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003ePrivilege Escalation, Sensitive Data Exposure\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://www.glassdoor.com/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eGlassdoor\u0026#39;s primary web application. A good place to start your testing\u003c/td\u003e\n\u003ctd\u003eInjection Attacks, Privilege Escalation\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://www.glassdoor.com/member/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eUser focused area contributions, my account, my information, resume uploads, and profile controls.\u003c/td\u003e\n\u003ctd\u003eInjection Attacks, Privilege Escalation\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://www.glassdoor.com/employers/ec/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eAccess control platform for employers to manage and review engagement, reviews, and management tools. Documentation: \u003ca href=\"https://www.glassdoor.com/employers/resources/glassdoor-employer-center-guide/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGlassdoor Employee Center Guide\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003eBroken Access Control, Privilege Escalation\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://www.glassdoor.com/Job/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eJob search features.\u003c/td\u003e\n\u003ctd\u003eInjection Attacks\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://www.glassdoor.com/Reviews/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eExplore company features.\u003c/td\u003e\n\u003ctd\u003eInjection Attacks\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://www.glassdoor.com/Compare/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eCompany comparison tool.\u003c/td\u003e\n\u003ctd\u003eInjection Attacks\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://www.glassdoor.com/mz-survey/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eCompany review survey.\u003c/td\u003e\n\u003ctd\u003eInjection Attacks\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://www.glassdoor.com/Salaries/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eSalary Discovery tool\u003c/td\u003e\n\u003ctd\u003eInjection Attacks\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://www.fishbowlapp.com/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eA a place for community conversations\u003c/td\u003e\n\u003ctd\u003ePrivilege escalation, sensitive data exposure, Injection attacks, broken access control\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003ehttps://api.fishbowlapp.com/*\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eFishbowl\u0026#39;s Restful API endpoint\u003c/td\u003e\n\u003ctd\u003ePrivilege escalation, sensitive data exposure\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e","rewardRangeData":{"1":{"min":3500,"max":7000},"2":{"min":1000,"max":3000},"3":{"min":300,"max":750},"4":{"min":50,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"5edc6acd-65d7-4e86-9378-2e4a71197fcd","name":"Out of Scope ","targets":[{"id":"1d5dd1c2-a402-463c-88c6-c83d28f8413b","uri":"","name":"Glassdoor Help Page ","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"58481b5d-a223-4b4c-b53f-66b768b81791","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"dfdaf5d2-f50f-4ff6-ad3c-7242a7fe7e19","uri":"","name":"Glassdoor Design Page","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8eda3bf2-016b-4fa8-becc-f4d6f9926a95","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"44c57215-f50d-4d7f-a9a3-6821781e8027","uri":"","name":"Glassdoor Blog","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c781739a-c621-4c24-a985-59ed7448f08c","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"d817dc19-4e9f-4ba6-a3ca-5dd4e0b1898a","code":"glassdoor-ogbb","state":"in_progress","endsAt":null,"bountyId":"2976019b-9bff-4205-ad2e-3f581c109804","startsAt":"2026-04-16T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Consumer Services","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/d55e/e4b6/2b577b21/1fb48bd12d4ddf682f5dedc5180b783f_1689875075461.jpeg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2026-04-16T18:00:00.757Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/glassdoor-ogbb","changelogs":"/engagements/glassdoor-ogbb/changelog","submissions":null,"announcements":"/engagements/glassdoor-ogbb/announcements","hallOfFame":"/engagements/glassdoor-ogbb/hall_of_fames","crowdstream":"/engagements/glassdoor-ogbb/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/glassdoor-ogbb/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=glassdoor-ogbb\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/glassdoor-ogbb/engagement_subscribers","engagementChangelogsUrl":"/engagements/glassdoor-ogbb/changelog","publishedAt":"2026-07-22T17:50:30.769Z","engagementChangelogUrl":"/engagements/glassdoor-ogbb/changelog/f2e7ea74-4b97-483d-9a51-d0da7e7f4b11","createUserFeedbacksUrl":"/engagements/glassdoor-ogbb/feedbacks","engagementCrowdstreamUrl":"/engagements/glassdoor-ogbb/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}