{"id":"a4580262-15c9-4be5-8e8e-e1987ab9cc1f","engagementId":"2100d485-4f49-46f6-aac1-c5bd11914f38","data":{"brief":{"id":"6545d25e-109e-4222-8944-06f5bcc78597","name":"Gusto VDP","tagline":"It’s time to tame the chaos of payroll, benefits, and HR.","description":"\u003cp\u003eGusto’s mission is to create a world where work empowers a better life. By making the most complicated business tasks simple and personal, Gusto is reimagining payroll, benefits and HR for modern companies. \u003c/p\u003e\n\n\u003cp\u003eSecurity is one of the top priorities at Gusto. We put the same amount of care in protecting our customers' information as we would with our own information. For that end, we would like to invite you to our bug bounty program. We appreciate your efforts and hard work in making the internet (and Gusto) more secure and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003ch2\u003eRules of Engagement\u003c/h2\u003e\n\n\u003cp\u003eActions which affect the integrity of availability of program targets are prohibited and strictly enforced. If you notice performance degradation on the target systems, you must immediately suspend all use of automated tools and notify Gusto immediately of the incident and provide details of the actions taken, when the performance degradation was believed to have started, and when your activity ceased.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eNo testing/submissions on *.gusto.com\u003c/li\u003e\n\u003cli\u003eNo rate-limiting or DoS attack related submissions\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Gusto not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Gusto, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eKnown Issues\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eServer Security Misconfiguration \u0026gt; Misconfigured DNS, OAuth Misconfiguration\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"8d6849c9-81c0-4e15-a051-02c17b9baeac","name":"In Scope","targets":[{"id":"c5371f31-8d96-433e-85fe-0ca52b422aad","uri":"https://docs.gusto.com/embedded-payroll/docs","name":"api.gusto-demo.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9604d5e1-49cb-405a-9bdf-4a28bfa775b3","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c5371f31-8d96-433e-85fe-0ca52b422aad"}],"recentChangeFlags":null},{"id":"0138ceb0-b641-4522-9090-9625688b60a6","uri":"https://dev.gusto.com/","name":"https://dev.gusto.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"884d4700-d2d2-4f5d-a8e4-21139d1d3dfd","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7175f742-0c91-48e8-ba7a-dcaa3508b48e","uri":"https://app.gusto-demo.com","name":"app.gusto-demo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e3ba693b-1341-4c71-8624-4d80b12b8e2a","sortOrder":0},"sortOrder":0,"tags":[{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"7175f742-0c91-48e8-ba7a-dcaa3508b48e"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"7175f742-0c91-48e8-ba7a-dcaa3508b48e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7175f742-0c91-48e8-ba7a-dcaa3508b48e"}],"recentChangeFlags":null},{"id":"0851b1db-af73-48d8-8b3b-2eb7c4bac6cc","uri":"https://github.com/Gusto/apollo-federation-ruby","name":"https://github.com/Gusto/apollo-federation-ruby","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cba4492b-5246-430c-a653-8029a218f0a2","sortOrder":0},"sortOrder":0,"tags":[{"id":"20f6988d-5b8c-41bb-9ca8-d9b271b7874d","name":"Github","targetId":"0851b1db-af73-48d8-8b3b-2eb7c4bac6cc"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0851b1db-af73-48d8-8b3b-2eb7c4bac6cc"}],"recentChangeFlags":null},{"id":"1b03fc98-24d5-42ed-b366-bafa93a3f413","uri":"https://github.com/Gusto/grpc-web-ruby","name":"https://github.com/Gusto/grpc-web-ruby","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"18a29548-508d-4f6d-aff5-b43cdd30fffe","sortOrder":0},"sortOrder":0,"tags":[{"id":"20f6988d-5b8c-41bb-9ca8-d9b271b7874d","name":"Github","targetId":"1b03fc98-24d5-42ed-b366-bafa93a3f413"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1b03fc98-24d5-42ed-b366-bafa93a3f413"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eAPI:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eNOTE:  This section applies to \u003cstrong\u003eAPI ONLY\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease signup for an account for testing the API here:  \u003ca href=\"https://dev.gusto.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://dev.gusto.com/\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eResearchers must use their \u003cstrong\u003e@bugcrowdninja.com\u003c/strong\u003e email address so we can properly filter the traffic.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAPI Documentation Link:  \u003ca href=\"http://docs.gusto.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttp://docs.gusto.com/\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAPI Video Link:  \u003ca href=\"https://www.loom.com/share/b374109a4f98499195e49f1e52330bc8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.loom.com/share/b374109a4f98499195e49f1e52330bc8\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"dbd8b7dd-e3fc-4190-bdac-e48399827f39","name":"In Scope - Mobile","targets":[{"id":"e87014f5-ebcf-4739-b3f4-4588e965063b","uri":"https://play.google.com/store/apps/details?id=com.gusto.money\u0026hl=en_US\u0026gl=US","name":"Android App:  Gusto Wallet","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"df2f2a69-f173-4891-83d2-4446c2063e28","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"e87014f5-ebcf-4739-b3f4-4588e965063b"}],"recentChangeFlags":null},{"id":"ef085871-45d1-4d09-a7f4-e9e6b88f0afa","uri":"https://apps.apple.com/us/app/gusto-wallet/id1478804271","name":"iOS App:  Gusto Wallet","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d462cbaf-efe6-425d-84af-8b7eef88c618","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"ef085871-45d1-4d09-a7f4-e9e6b88f0afa"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"2100d485-4f49-46f6-aac1-c5bd11914f38","code":"gusto-vdp","state":"in_progress","endsAt":null,"bountyId":"c8e45124-bcd4-465f-949c-b1ee670428bd","startsAt":"2022-04-14T05:30:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/1569/da40/d454514d/66e15c7c3bc5ac9994afef2a921866cc_gusto-logo-white-square-512.png","logoBackgroundColor":"#FF4833","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2022-04-14T05:30:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/gusto-vdp","changelogs":"/engagements/gusto-vdp/changelog","submissions":null,"announcements":"/engagements/gusto-vdp/announcements","hallOfFame":"/engagements/gusto-vdp/hall_of_fames","crowdstream":"/engagements/gusto-vdp/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/gusto-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=gusto-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/gusto-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/gusto-vdp/changelog","publishedAt":"2025-12-23T19:53:29.799Z","engagementChangelogUrl":"/engagements/gusto-vdp/changelog/a4580262-15c9-4be5-8e8e-e1987ab9cc1f","createUserFeedbacksUrl":"/engagements/gusto-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/gusto-vdp/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}