{"id":"26c9825f-5a8d-4657-a224-6eb4ab8828f4","engagementId":"af5ee612-160e-49c9-ac1c-c6eb8c4277fe","data":{"brief":{"id":"87230d27-0003-41b7-a379-c286098000b5","name":"IAG Loyalty (Avios) Vulnerability Disclosure Program","tagline":"IAG Loyalty, a subsidiary of IAG, was established in 1988 as Airmiles and later Avios in 2011, now known as IAGL, with over 30 years of experience in loyalty programs.","description":"\u003cp\u003eIAG Loyalty is part of International Airlines Group (IAG). We were founded as Airmiles in 1988 and became Avios in 2011, now we’re IAGL and we have over 30 years’ experience in loyalty. \u003c/p\u003e\n\n\u003cp\u003eWe manage the British Airways Club, Iberia Plus, Vueling Club, and the Aer Lingus AerClub, and we have an impressive range of retail, travel and financial services partners of the Avios currency.\u003c/p\u003e\n\n\u003cp\u003eWe’re loyalty pioneers creating the world’s most rewarding experiences. Thank you for making our apps more secure!\u003c/p\u003e\n\n\u003cp\u003eThis Vulnerability Disclosure Program (VDP) invites security researchers to report potential vulnerabilities in our systems safely, responsibly, and in coordination with us.\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eRules of engagement\u003c/h2\u003e\n\n\u003cp\u003eVulnerabilities may only be reported via the bugcrowd platform and may only be sent to us. The submission of vulnerabilities via other channels is not permitted and will not be recognised within this program.\u003c/p\u003e\n\n\u003cp\u003eEmployees, service providers, and individuals in a working relationship with International Airline Group or any of its subsidiaries are excluded from the program. All other security researchers who wish to help us improve the security of our systems are welcome to take part in the program.\u003c/p\u003e\n\n\u003cp\u003eDo not publicly disclose any details of the vulnerability, indicator of vulnerability, or the content of information rendered available by a vulnerability, except upon receiving explicit written authorization from International Airlines Group.\u003c/p\u003e\n\n\u003cp\u003ePlease provide detailed technical reports with reproducible steps. Include, screenshots, proof-of-concept URLs. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.\u003c/p\u003e\n\n\u003cp\u003eSubmit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.\u003c/p\u003e\n\n\u003cp\u003eWhen duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).\u003c/p\u003e\n\n\u003cp\u003eMultiple vulnerabilities caused by one underlying issue will be treated as one valid report.\u003c/p\u003e\n\n\u003cp\u003eSocial engineering (e.g. phishing, vishing, smishing) is prohibited.\u003c/p\u003e\n\n\u003cp\u003eMake a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.\u003c/p\u003e\n\n\u003cp\u003eAs a Researcher, you are bound by Bugcrowd's Code of Conduct and Terms of Service, as well as this Program Brief.\u003c/p\u003e\n\n\u003cp\u003eDo no harm and do not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.\u003c/p\u003e\n\n\u003cp\u003eAvoid intentionally accessing the content of any International Airlines Group data in transit or data at rest, except to the extent that the information is directly related to a vulnerability and the access is necessary to prove that the vulnerability exists.\u003c/p\u003e\n\n\u003cp\u003eDo not perform testing activities against any accounts that you do not own.\u003c/p\u003e\n\n\u003cp\u003eDo not conduct physical attacks on branch offices or computing centres.\u003c/p\u003e\n\n\u003cp\u003eDo not exfiltrate any data under any circumstances.\u003c/p\u003e\n\n\u003cp\u003eDo not compromise the privacy or safety of International Airlines Group personnel or any third parties.\u003c/p\u003e\n\n\u003cp\u003eDo not intentionally compromise the intellectual property or commercial interests of any International Airlines Group personnel or entities, or any third parties.\u003c/p\u003e\n\n\u003cp\u003eDo not conduct denial of service (DOS) testing.\u003c/p\u003e\n\n\u003cp\u003eDo not submit a high-volume of low-quality reports.\u003c/p\u003e\n\n\u003cp\u003eIf at any point you are uncertain whether to continue testing, please engage with our team.\u003c/p\u003e\n\n\u003ch3\u003eConfidentiality Obligations\u003c/h3\u003e\n\n\u003cp\u003eThe Researcher agrees to maintain the strict confidentiality of all Confidential Information (see \u003ca href=\"https://www.bugcrowd.com/resources/hacker-resources/standard-disclosure-terms/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd's Terms of Service\u003c/a\u003e for definition) and shall not disclose publicly, use or permit the use of such Confidential Information for any purpose other than as expressly authorised by this Program Brief and Bugcrowd's Terms of Service.\u003c/p\u003e\n\n\u003cp\u003eThe Researcher acknowledges and agrees that any breach of the confidentiality obligations set out in this Program Brief and Bugcrowd's Terms of Service may result in irreparable harm to Us, for which monetary damages may not be an adequate remedy. Accordingly, we will be entitled to seek injunctive relief, specific performance, or any other equitable remedy in addition to pursuing legal actions and claims for damages against the Researcher.\u003c/p\u003e","industryTagId":"2bf483dc-2f0b-4e2d-b7f0-568b8cc28809","targetsOverview":"\u003cp\u003eIf you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to IAG Loyalty, you can report it to this engagement.\u003c/p\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"bbabbec5-277a-42f0-9d72-8c7e7387c6ee","name":"In scope","targets":[{"id":"96900767-57b1-4ddb-9347-420b6694a585","uri":"https://accounts.britishairways.com/security/","name":"Custom Build Identity Services","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"88cfeacb-d475-4a19-84ae-eec13af782ea","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"96900767-57b1-4ddb-9347-420b6694a585"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"96900767-57b1-4ddb-9347-420b6694a585"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"96900767-57b1-4ddb-9347-420b6694a585"}],"recentChangeFlags":null},{"id":"1d890880-b004-419b-a19f-94d4bc0c4262","uri":"https://www.avios.com/","name":"www.avios.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"20d52858-68f4-43d4-a5c8-86f8c7070d75","sortOrder":1},"sortOrder":1,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"1d890880-b004-419b-a19f-94d4bc0c4262"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1d890880-b004-419b-a19f-94d4bc0c4262"}],"recentChangeFlags":null},{"id":"cceb4850-1cbd-4f1d-94ba-d53d11483061","uri":"https://www.avios.com/api/","name":"www.avios.com/api/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5f5ceedd-3710-4968-8200-21fcdefa3692","sortOrder":2},"sortOrder":2,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"cceb4850-1cbd-4f1d-94ba-d53d11483061"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cceb4850-1cbd-4f1d-94ba-d53d11483061"}],"recentChangeFlags":null},{"id":"b3fd9842-07d6-4d77-ad25-ff1ee8c94e32","uri":"https://www.avios.com/collect-avios/buy","name":"www.avios.com/collect-avios/buy*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4cf86c1b-03a6-4692-b151-f7ba7437f79b","sortOrder":3},"sortOrder":3,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"b3fd9842-07d6-4d77-ad25-ff1ee8c94e32"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b3fd9842-07d6-4d77-ad25-ff1ee8c94e32"}],"recentChangeFlags":null},{"id":"7e389883-ef3f-4db5-ad06-c69291da1f13","uri":"https://www.avios.com/manage-avios/move-and-combine-avios/partner","name":"www.avios.com/manage-avios/move-and-combine-avios/partner*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0c917d4b-46cd-451b-8d89-64c277768bb9","sortOrder":4},"sortOrder":4,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"7e389883-ef3f-4db5-ad06-c69291da1f13"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7e389883-ef3f-4db5-ad06-c69291da1f13"}],"recentChangeFlags":null},{"id":"5d4d3884-8a9e-49f8-8466-6e6351cc7585","uri":"https://www.avios.com/vertis","name":"www.avios.com/vertis*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b5b9790a-7c05-45b3-b1cd-b3adf8602c36","sortOrder":5},"sortOrder":5,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"5d4d3884-8a9e-49f8-8466-6e6351cc7585"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5d4d3884-8a9e-49f8-8466-6e6351cc7585"}],"recentChangeFlags":null},{"id":"e53c6283-96d8-44ae-8a70-42dd5538ad71","uri":"https://www.avios.com/exchange*","name":"www.avios.com/exchange*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4407ee24-5f20-4035-8d82-714dc81e03eb","sortOrder":6},"sortOrder":6,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"e53c6283-96d8-44ae-8a70-42dd5538ad71"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e53c6283-96d8-44ae-8a70-42dd5538ad71"}],"recentChangeFlags":null},{"id":"68aedef9-a1fb-4f65-bc1f-a82d99a54a50","uri":"https://www.avios.com/spend-avios/rewards*","name":"www.avios.com/spend-avios/rewards","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b74523e8-7fce-4128-be3e-b262fd8b3c12","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"68aedef9-a1fb-4f65-bc1f-a82d99a54a50"}],"recentChangeFlags":null},{"id":"ba033ad2-83dd-49cc-938b-672fc512974f","uri":"","name":"www.avios.com/??-??/spend-avios/rewards*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"153a3781-b0f3-4e24-82fd-35aaf4bde7c0","sortOrder":8},"sortOrder":8,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"ba033ad2-83dd-49cc-938b-672fc512974f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ba033ad2-83dd-49cc-938b-672fc512974f"}],"recentChangeFlags":null},{"id":"95152e7a-16cb-4812-b133-39112646c826","uri":"https://www.avios.com/spend-avios/vouchers*","name":"www.avios.com/spend-avios/vouchers*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"aea56120-9cbb-4507-a172-5329a9f7699d","sortOrder":9},"sortOrder":9,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"95152e7a-16cb-4812-b133-39112646c826"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"95152e7a-16cb-4812-b133-39112646c826"}],"recentChangeFlags":null},{"id":"04694635-f9e5-4ea5-aec0-ae33918a3e71","uri":"","name":"www.avios.com/??-??/collect-avios*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"644acfc1-5fdb-47be-9edd-46f5237fc2ba","sortOrder":10},"sortOrder":10,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"04694635-f9e5-4ea5-aec0-ae33918a3e71"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"04694635-f9e5-4ea5-aec0-ae33918a3e71"}],"recentChangeFlags":null},{"id":"b5b67d09-8804-4281-b88e-92e540206349","uri":"https://www.avios.com/collect-avios","name":"www.avios.com/collect-avios*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fe0be829-b96f-4709-85b6-d75e884de53f","sortOrder":11},"sortOrder":11,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"b5b67d09-8804-4281-b88e-92e540206349"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b5b67d09-8804-4281-b88e-92e540206349"}],"recentChangeFlags":null},{"id":"0a5f9a53-9cb7-4e5b-a688-840d550539bc","uri":"","name":"www.avios.com/??-??/spend-avios*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a01a5751-ec01-4a8a-bf7b-902a1093af8c","sortOrder":12},"sortOrder":12,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"0a5f9a53-9cb7-4e5b-a688-840d550539bc"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0a5f9a53-9cb7-4e5b-a688-840d550539bc"}],"recentChangeFlags":null},{"id":"96279df4-2c08-4437-acba-683fccbdc9f3","uri":"https://www.avios.com/spend-avios*","name":"www.avios.com/spend-avios*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d36536f8-4e6c-4a2c-b830-8ea6e1374e0b","sortOrder":13},"sortOrder":13,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"96279df4-2c08-4437-acba-683fccbdc9f3"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"96279df4-2c08-4437-acba-683fccbdc9f3"}],"recentChangeFlags":null},{"id":"b44173c2-c9e6-4215-82c8-e5bb863e13a1","uri":"https://www.avios.com/sign-up","name":"www.avios.com/sign-up","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cbd9667d-4712-4c40-886c-1be5df0a05b0","sortOrder":14},"sortOrder":14,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"b44173c2-c9e6-4215-82c8-e5bb863e13a1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b44173c2-c9e6-4215-82c8-e5bb863e13a1"}],"recentChangeFlags":null},{"id":"fc80ec67-2099-495a-b074-c1b69668afec","uri":"","name":" stg.avios.com/move/transfer-avios/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8172d116-5327-4334-b4ec-250f3ae78cbe","sortOrder":15},"sortOrder":15,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fc80ec67-2099-495a-b074-c1b69668afec"}],"recentChangeFlags":null},{"id":"92de9659-0bcb-4ae3-bdcc-4f9460f82357","uri":"https://www.avios.com/gc","name":"www.avios.com/gc*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5dde0b57-a290-412d-8ef2-dcdffc6e5554","sortOrder":16},"sortOrder":16,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"92de9659-0bcb-4ae3-bdcc-4f9460f82357"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"92de9659-0bcb-4ae3-bdcc-4f9460f82357"}],"recentChangeFlags":null},{"id":"9676cc87-e72d-4ba6-82bc-d7e83203d307","uri":"","name":"www.avios.com/??-??/avios-shop*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f9e46528-74ef-4cf7-9cde-215cde3792ef","sortOrder":17},"sortOrder":17,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"9676cc87-e72d-4ba6-82bc-d7e83203d307"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9676cc87-e72d-4ba6-82bc-d7e83203d307"}],"recentChangeFlags":null},{"id":"6df4a251-4a7c-45b3-a6f7-165ce09a7485","uri":"https://www.avios.com/avios-shop","name":"www.avios.com/avios-shop*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f4417cea-968c-4d2a-8aef-a9f3295d08fa","sortOrder":18},"sortOrder":18,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"6df4a251-4a7c-45b3-a6f7-165ce09a7485"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6df4a251-4a7c-45b3-a6f7-165ce09a7485"}],"recentChangeFlags":null},{"id":"94ac8621-6d18-4689-b6e3-c9cfb79c624a","uri":"https://rewardsapp.iagl.digital/v3","name":"rewardsapp.iagl.digital/v3","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"beef4d31-de70-4e15-998c-a1b855a0770a","sortOrder":19},"sortOrder":19,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"94ac8621-6d18-4689-b6e3-c9cfb79c624a"}],"recentChangeFlags":null},{"id":"196a346a-e149-44c5-ba94-37732ac9be55","uri":"https://thewineflyer.co.uk/","name":"thewineflyer.co.uk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0f2ed07f-a04d-4430-843d-cf229b52f79e","sortOrder":20},"sortOrder":20,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"196a346a-e149-44c5-ba94-37732ac9be55"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"196a346a-e149-44c5-ba94-37732ac9be55"}],"recentChangeFlags":null},{"id":"f65aefe9-c039-4ea0-b4ce-41ea7ec76df1","uri":"https://developer.iagloyalty.com/","name":"developer.iagloyalty.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"344726ec-30d2-49c3-a82e-17a66ee0f8ed","sortOrder":21},"sortOrder":21,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"f65aefe9-c039-4ea0-b4ce-41ea7ec76df1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f65aefe9-c039-4ea0-b4ce-41ea7ec76df1"}],"recentChangeFlags":null},{"id":"d3dc6274-0814-4c32-8c95-414871be7635","uri":"https://play.google.com/store/apps/details?id=com.usablenet.ba.avios","name":"Avios Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"af27b444-3aaa-4f56-bf81-44930744dbb2","sortOrder":22},"sortOrder":22,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"d3dc6274-0814-4c32-8c95-414871be7635"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"d3dc6274-0814-4c32-8c95-414871be7635"}],"recentChangeFlags":null},{"id":"3a8cc7a8-3969-48d8-ad9d-e56e66ca30da","uri":"https://apps.apple.com/es/app/avios-shop-collect-travel/id1388235740","name":"Avios iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b0c9ffc1-5bfa-483d-ba28-fa0856b496bb","sortOrder":23},"sortOrder":23,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"3a8cc7a8-3969-48d8-ad9d-e56e66ca30da"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"3a8cc7a8-3969-48d8-ad9d-e56e66ca30da"}],"recentChangeFlags":null},{"id":"a63ed541-8322-4df5-89e7-ac60914b52d3","uri":"https://holiday.britishairways.com","name":"holiday.britishairways.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d367a800-008f-416f-809a-117ee039f586","sortOrder":24},"sortOrder":24,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"a63ed541-8322-4df5-89e7-ac60914b52d3"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"a63ed541-8322-4df5-89e7-ac60914b52d3"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a63ed541-8322-4df5-89e7-ac60914b52d3"}],"recentChangeFlags":null},{"id":"6b26db33-e7c5-4f83-abc7-85ee8e2d31f8","uri":"https://estore.aerlingus.com/en-IE/retailers","name":"estore.aerlingus.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c88316f1-47b3-49ac-9e3d-c3b9d051f69f","sortOrder":25},"sortOrder":25,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"6b26db33-e7c5-4f83-abc7-85ee8e2d31f8"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6b26db33-e7c5-4f83-abc7-85ee8e2d31f8"}],"recentChangeFlags":null},{"id":"e51b16b7-269a-44e7-9fb4-54ff2489fe45","uri":"https://pgt.estore.aerlingus.com","name":"pgt.estore.aerlingus.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7c1b1e22-47fe-4784-99f3-ae05ba85cedf","sortOrder":26},"sortOrder":26,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"e51b16b7-269a-44e7-9fb4-54ff2489fe45"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e51b16b7-269a-44e7-9fb4-54ff2489fe45"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eIAG Loyalty is part of International Airlines Group (IAG). We manage the British Airways Executive Club, Iberia Plus, Vueling Club, and the Aer Lingus AerClub, and we have an impressive range of retail, travel and financial services partners of the Avios currency. We’re loyalty pioneers creating the world’s most rewarding experiences. We help people to enjoy incredible experiences by collecting and redeeming the iconic Avios currency. We design customer loyalty programmes, build loyalty management tools, provide loyalty tech solutions, and produce invaluable data and customer insights to turn customer loyalty into a powerful tool for maximising a brand power and scale.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"af5ee612-160e-49c9-ac1c-c6eb8c4277fe","code":"iagloyalty-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"5912254c-d935-4f46-b6dc-988ad67c4f7f","startsAt":"2025-09-02T06:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Transportation","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/53a8/4122/f41485a8/d039bf0dbd737daa9baf4204e16a6569_iag_loyalty_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-09-02T06:00:00.729Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/iagloyalty-vdp-pro","changelogs":"/engagements/iagloyalty-vdp-pro/changelog","submissions":null,"announcements":"/engagements/iagloyalty-vdp-pro/announcements","hallOfFame":"/engagements/iagloyalty-vdp-pro/hall_of_fames","crowdstream":"/engagements/iagloyalty-vdp-pro/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/iagloyalty-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=iagloyalty-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/iagloyalty-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/iagloyalty-vdp-pro/changelog","publishedAt":"2026-05-08T13:51:53.897Z","engagementChangelogUrl":"/engagements/iagloyalty-vdp-pro/changelog/26c9825f-5a8d-4657-a224-6eb4ab8828f4","createUserFeedbacksUrl":"/engagements/iagloyalty-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/iagloyalty-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}