{"id":"112af3b9-e1ec-486e-855d-e5977ab90908","engagementId":"79c66f97-9c03-4c39-93d1-67223e2d4323","data":{"brief":{"id":"5e1790db-a54b-40d8-8fc3-bcc2408287e3","name":"Ibotta","tagline":"Mobile app providing cash back for users through in-app purchases, loyalty card integrations, payments, and receipt scanning.","description":"\u003cp\u003eIbotta is a performance marketing platform based in Denver, CO, allows brands to deliver digital promotions to over 200 million consumers through the Ibotta Performance Network (IPN). The platform focuses on making every purchase rewarding and has credited American consumers $1.8 billion. Ibotta has been recognized as a Top Workplace by The Denver Post, BuiltIn Colorado's Best Places to Work list, and Inc.'s Best Workplaces list.\u003c/p\u003e\n\n\u003cp\u003eNo technology is perfect, and Ibotta believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our target. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher—along with the opportunity to appeal and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch1\u003eAll domains/properties owned by Ibotta are in scope!\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003eIbotta continuously pushes out new code.\u003c/li\u003e\n\u003cli\u003ePlease take care when testing on production not to compromise the functioning of any Ibotta assets or users on the platform.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eRecent Scope Additions\u003c/h3\u003e\n\n\u003cp\u003eWe highly recommend you take a look at this additional attack surface – which hopefully means more vulnerabilities! \u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eName\u003c/th\u003e\n\u003cth\u003eURL\u003c/th\u003e\n\u003cth\u003eDescription\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eChrome Extension Beta\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://chrome.google.com/webstore/detail/ibotta-browser-extension/mfaedmjlefifhnhpgipjjiiekchaimpk?hl=en-US\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAccess Here\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\n\u003ca href=\"https://help.ibotta.com/hc/en-us/articles/360007506380-Ibotta-Browser-Extension-How-it-Works-\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHere is a User Guide\u003c/a\u003e The Ibotta team is looking for testing that ensures the pop-up interaction with their other product areas (such as the next item or loyalty card linking) is secure and would like to know about any sensitive data exposure.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eWeb v2\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://app.ibotta.com/sign-in%E2%80%A9\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAccess Here\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003eThis is a refreshed web application for the Ibotta Team. Please note that there are some scope exclusions for this target: Access Token Exposure, the ability to scrape the site, and data flow to 3rd parties is intended and reports will be considered informational unless they are chained to create a larger vulnerability.\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ch3\u003eAll vulnerability reports must be submitted exclusively through the Bugcrowd platform. Attempts to contact Ibotta security or care teams directly regarding vulnerability reports will not be addressed.\u003c/h3\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eResearchers can self register for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://researcherdocs.bugcrowd.com/v2.0/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eResearchers will need to have \u003cspan class=\"rp-resources__download-link bc-m-0 bc-icon bc-icon--after cc-icon--download\" data-tooltip-id=\"9ca3aebe-1da4-4a6e-b970-c50d28198658\"\u003e\u003ca href=\"https://bugcrowd.com/engagements/ibotta/attachments/9ca3aebe-1da4-4a6e-b970-c50d28198658\" download\u003ea rewards account on any of these grocery chains\u003c/a\u003e\u003c/span\u003e. These will not be provisioned by Bugcrowd or Ibotta.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eGeo Restrictions\u003c/strong\u003e Ibotta is currently for US use only. International researchers are welcome to test against Ibotta assets but must do so through a US IP address (through a self provisioned proxy/vpn).\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eHelpful Information\u003c/h2\u003e\n\n\u003ch3\u003eAccount Flow\u003c/h3\u003e\n\n\u003cp\u003eThe below documentation contains information regarding how to initiate and use the flow of the application, and API endpoint data and examples. We also have included a video on how to initiate and use the flow.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eDocumentation 1: \u003cspan class=\"rp-resources__download-link bc-m-0 bc-icon bc-icon--after cc-icon--download\" data-tooltip-id=\"9ca3aebe-1da4-4a6e-b970-c50d28198658\"\u003e\u003ca href=\"https://bugcrowd.com/engagements/ibotta/attachments/9ca3aebe-1da4-4a6e-b970-c50d28198658\" download\u003ePay with  Ibotta Flow.docx\u003c/a\u003e\u003c/span\u003e\n\u003c/li\u003e\n\u003cli\u003eDocumentation 2: \u003cspan class=\"rp-resources__download-link bc-m-0 bc-icon bc-icon--after cc-icon--download\" data-tooltip-id=\"84db3509-3b42-48f0-a8fc-ce6d247ea8e1\"\u003e\u003ca href=\"https://bugcrowd.com/engagements/ibotta/attachments/84db3509-3b42-48f0-a8fc-ce6d247ea8e1\" download\u003eIbotta - Account Linking Flow.docx\u003c/a\u003e\u003c/span\u003e\n\u003c/li\u003e\n\u003cli\u003eVideo: Can be downloaded from the Resources tab\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eChrome Extension\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003ca href=\"https://help.ibotta.com/hc/en-us/articles/360007506380-Ibotta-Browser-Extension-How-it-Works-\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHere is a User Guide\u003c/a\u003e The Ibotta team is looking for testing that ensures the pop-up interaction with their other product areas (such as the next item or loyalty card linking) is secure and would like to know about any sensitive data exposure. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eCash out\u003c/h3\u003e\n\n\u003cp\u003eA key use case for the Ibotta application is cashing out.  For testing cash out in this program please be aware of the following:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePaypal, Venmo, and giftcard cashout methods are live.  Because of this, accounts will not be funded again.\u003c/li\u003e\n\u003cli\u003eCashout thresholds are reduced for the bugcrowd provisioned accounts to facilitate testing.\u003c/li\u003e\n\u003cli\u003eSMS authentication is enabled for all accounts. Because of fraud scoring, VoIP numbers (Google Voice, etc) may be blocked.\u003c/li\u003e\n\u003cli\u003eCritical requests are rate-limited and geoip filtered. Requests from outside the US are not likely to be allowed.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eTechnology\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe mobile apps are both native\u003c/li\u003e\n\u003cli\u003eServers are Ruby/Rails on Ubuntu\u2028\u003c/li\u003e\n\u003cli\u003eHosted on AWS, API endpoints behind Elastic LoadBalancer\u2028\u003c/li\u003e\n\u003cli\u003eInfrastructure includes Memcache, Redis and MySQL\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003col\u003e\n\u003cli\u003eAny ability for an attacker to sniff Grocery retailers credentials entered into Ibotta.\u003c/li\u003e\n\u003cli\u003eAll phone logs, especially exceptions, need to be verified to not include credentials.\u003c/li\u003e\n\u003cli\u003eCheck for plaintext customer sensitive information sent to 3rd party from our endpoints.\u003c/li\u003e\n\u003cli\u003eInput validation for database access for protection against injection.\u003c/li\u003e\n\u003cli\u003eTest the restriction of HTTP methods to those we are in control of, or any attack vector against our endpoints.\u003c/li\u003e\n\u003cli\u003e2FA bypass and/or compromising account integrity.\u003c/li\u003e\n\u003cli\u003eCashout threshold and value manipulation.\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eN-day/Third-Party 0-day Policy\u003c/h2\u003e\n\n\u003cp\u003eWhen N-day or third-party 0-day vulnerabilities are released publicly, we will consider them in scope after a grace period of 7 days has elapsed.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eExample: If an N-day vulnerability is released on 01/01/2025, it would be considered in-scope starting 01/08/2025.\u003c/li\u003e\n\u003cli\u003eBounty reports submitted on vulnerabilities that were made public less than 7 days ago will be paid at the sole discretion of Ibotta.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eWe ask that you only test on Ibotta owned assets and are respectful of our customers.\u003c/h2\u003e\n\n\u003ch4\u003eAll testing must abide by \u003ca href=\"https://aws.amazon.com/security/penetration-testing/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAWS's rules on penetration testing\u003c/a\u003e.\u003c/h4\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eTesting of third-party services used by Ibotta, except where explicitly permitted as 'In Scope'\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003einvestors.ibotta.com, ir.ibotta.com \u0026amp; trust.ibotta.com are hosted by third parties and are *\u003cem\u003eout of scope *\u003c/em\u003e\n\u003c/li\u003e\n\u003cli\u003eNo attacks/tests of any kind should be performed on the Grocery websites/properties\u003c/li\u003e\n\u003cli\u003eCreating counterfeit receipts and barcodes\u003c/li\u003e\n\u003cli\u003eDouble submission of receipts\u003c/li\u003e\n\u003cli\u003eOther customer-support situations\u003c/li\u003e\n\u003cli\u003eDenial of Service via high rate requests or other nonstandard requests\u003c/li\u003e\n\u003cli\u003eRate limiting on endpoints\u003c/li\u003e\n\u003cli\u003eSubdomain takeovers\u003c/li\u003e\n\u003cli\u003eDmarc/Email spoofing\u003c/li\u003e\n\u003cli\u003eLack of source code obfuscation (ios-class-guard, ProGuard) for mobile apps\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRegarding Webv2;\u003c/strong\u003e Access Token Exposure, the ability to scrape the site, and data flow to 3rd parties is intended and reports will be considered informational unless they are chained to create a larger vulnerability\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRegarding the mobile App;\u003c/strong\u003e Access Token/Public Key Exposure, and data flow to 3rd parties is intended and reports will be considered informational unless they are chained to create a larger vulnerability\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eRating Taxonomy\u003c/h3\u003e\n\n\u003cp\u003eThis program adheres to the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for the prioritization of findings.\u003c/p\u003e\n\n\u003ch3\u003eSafe Harbor:\u003c/h3\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":"\u003cp\u003e\u003cstrong\u003eImportant:\u003c/strong\u003e\u003cbr\u003e\nContacting Ibotta's support team directly to inquire about the status or examination of a BugCrowd submission (\"Submission\") will result in an immediate disqualification from receiving rewards.  ALL communications must be conducted through the CrowdControl platform only.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePublic Zero-Day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case-by-case basis.\u003c/li\u003e\n\u003c/ul\u003e"},"scope":[{"id":"686e1385-5884-4f96-8982-a68c14034cb7","name":"In Scope Targets ","targets":[{"id":"d508abac-dfcb-4afa-8f6e-d58b8cde61e5","uri":"https://chrome.google.com/webstore/detail/ibotta-browser-extension/mfaedmjlefifhnhpgipjjiiekchaimpk?hl=en-US","name":"Chrome Extension","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1fb8e595-96df-4410-93ed-46240cbfb7e9","sortOrder":0},"sortOrder":0,"tags":[{"id":"59791207-9cf4-4498-b5e1-510fee95dc40","name":"Browser Extension","targetId":"d508abac-dfcb-4afa-8f6e-d58b8cde61e5"}],"recentChangeFlags":null},{"id":"b12853d7-121a-4f1b-8403-a145fb9a9f3e","uri":"http://market.android.com/details?id=com.ibotta.android","name":"http://market.android.com/details?id=com.ibotta.android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"42006f5f-a81b-4343-8d62-eca1bef101cb","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"b12853d7-121a-4f1b-8403-a145fb9a9f3e"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"b12853d7-121a-4f1b-8403-a145fb9a9f3e"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"b12853d7-121a-4f1b-8403-a145fb9a9f3e"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"b12853d7-121a-4f1b-8403-a145fb9a9f3e"}],"recentChangeFlags":null},{"id":"fbf9cb2b-f9e6-4c89-aaac-b6c69f6f1b3c","uri":"http://itunes.apple.com/us/app/ibotta/id559887125","name":"http://itunes.apple.com/us/app/ibotta/id559887125","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e9f1bcad-371c-4815-93b1-4a8b0e6f8d1c","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"fbf9cb2b-f9e6-4c89-aaac-b6c69f6f1b3c"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"fbf9cb2b-f9e6-4c89-aaac-b6c69f6f1b3c"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"fbf9cb2b-f9e6-4c89-aaac-b6c69f6f1b3c"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"fbf9cb2b-f9e6-4c89-aaac-b6c69f6f1b3c"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"fbf9cb2b-f9e6-4c89-aaac-b6c69f6f1b3c"}],"recentChangeFlags":null},{"id":"05258f3f-9d75-469e-a4d6-d24213cfc089","uri":"https://content-server.ibotta.com/graphql","name":"https://content-server.ibotta.com/graphql","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2945bb7b-8a65-46f0-b1df-8cac1370e1ef","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"05258f3f-9d75-469e-a4d6-d24213cfc089"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"05258f3f-9d75-469e-a4d6-d24213cfc089"}],"recentChangeFlags":null},{"id":"7de482c1-18b1-4e5e-a1e2-6b18c28e7818","uri":"https://api.ibotta.com","name":"https://api.ibotta.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c335c162-316c-454b-9c04-d42edd71a964","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"7de482c1-18b1-4e5e-a1e2-6b18c28e7818"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"7de482c1-18b1-4e5e-a1e2-6b18c28e7818"}],"recentChangeFlags":null},{"id":"d213cd65-2d83-4525-88b5-a948345fdf30","uri":"https://api.ibops.net","name":"https://api.ibops.net","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f3d3a79f-4389-4793-8a3c-c0a1ceaefa65","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d213cd65-2d83-4525-88b5-a948345fdf30"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"d213cd65-2d83-4525-88b5-a948345fdf30"}],"recentChangeFlags":null},{"id":"467503cb-268f-4d89-b387-7c415a44765a","uri":"https://api.int.ibops.net","name":"https://api.int.ibops.net","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d2f3810f-b584-4746-8bf3-cb9629f544e9","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"467503cb-268f-4d89-b387-7c415a44765a"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"467503cb-268f-4d89-b387-7c415a44765a"}],"recentChangeFlags":null},{"id":"64a19d69-d449-423f-a3e6-b695d74887c0","uri":"https://api.int.ibops.net/customer-loyalty-service","name":"https://api.int.ibops.net/customer-loyalty-service","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ffec0cd3-679c-4c33-9ef4-5b8f59288769","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"64a19d69-d449-423f-a3e6-b695d74887c0"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"64a19d69-d449-423f-a3e6-b695d74887c0"}],"recentChangeFlags":null},{"id":"d405bda7-38f5-4b8d-9d6c-c740aee55086","uri":"https://api.ibops.net/ad-management","name":" https://api.ibops.net/ad-management","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"884bbede-0b66-4276-9c1e-65af24dd0913","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d405bda7-38f5-4b8d-9d6c-c740aee55086"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"d405bda7-38f5-4b8d-9d6c-c740aee55086"}],"recentChangeFlags":null},{"id":"2ab9790c-a9aa-44a6-8427-cec6d891184a","uri":null,"name":"Ibotta App Data \u0026 Memory","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c6449bab-8934-474d-8997-06109d4c3dfe","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"f144d312-4c43-4b04-a33c-ab67391b9f8c","uri":"https://app.ibotta.com/sign-in\u2029","name":"Web v2","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"adbdf3ac-6ea5-42d6-b69b-99c91d12b53c","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f144d312-4c43-4b04-a33c-ab67391b9f8c"}],"recentChangeFlags":null},{"id":"8a20f1ef-574b-46a9-83ad-59cdf1a02fc6","uri":"http://ibotta.com","name":"http://ibotta.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"77ded400-cf4b-466d-8934-a5335e0ab81f","sortOrder":0},"sortOrder":0,"tags":[{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"8a20f1ef-574b-46a9-83ad-59cdf1a02fc6"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"8a20f1ef-574b-46a9-83ad-59cdf1a02fc6"},{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"8a20f1ef-574b-46a9-83ad-59cdf1a02fc6"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"8a20f1ef-574b-46a9-83ad-59cdf1a02fc6"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"8a20f1ef-574b-46a9-83ad-59cdf1a02fc6"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"8a20f1ef-574b-46a9-83ad-59cdf1a02fc6"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"8a20f1ef-574b-46a9-83ad-59cdf1a02fc6"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8a20f1ef-574b-46a9-83ad-59cdf1a02fc6"}],"recentChangeFlags":null},{"id":"743dd837-6cf5-47e3-bc08-3c8671e5ad86","uri":"https://backend.ibotta.com/","name":"https://backend.ibotta.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d6328cc0-c66e-4483-8847-97d3e91fab4b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"743dd837-6cf5-47e3-bc08-3c8671e5ad86"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"8ca10ce0-6c4f-469d-aaa5-73c7c1fb1d03","p1MaxCents":100000,"p1MinCents":100000,"p2MaxCents":75000,"p2MinCents":75000,"p3MaxCents":50000,"p3MinCents":50000,"p4MaxCents":25000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eThe web APIs are updated daily, and the mobile app is updated bi-weekly. In the event you don\u0026#39;t find anything today, there may be something present tomorrow and as such, vulnerability reports on these targets are of the highest impact to the Ibotta team and have a higher reward range!  \u003c/p\u003e\n\n\u003cp\u003eThe Chrome extension was recently moved out of Beta so we are particularly interested in testing that ensures the pop-up interaction with their other product areas (such as the next item or loyalty card linking) is secure and would like to know about any sensitive data exposure. \u003c/p\u003e","rewardRangeData":{"1":{"min":1000,"max":1000},"2":{"min":750,"max":750},"3":{"min":500,"max":500},"4":{"min":250,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"239aec32-4f96-4551-a342-409cdfd4edd8","name":"Out of Scope Targets","targets":[{"id":"bec2a2c4-5a81-4d53-b8b6-5079c517455e","uri":null,"name":"https://backend.ibotta.com/duplicate_receipt_moderation","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"63d27ce2-8c99-4440-bc84-94ee36f28546","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"bec2a2c4-5a81-4d53-b8b6-5079c517455e"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"bec2a2c4-5a81-4d53-b8b6-5079c517455e"}],"recentChangeFlags":null},{"id":"b571b988-ebdf-4701-a9e6-9e17eeb2fefc","uri":"https://ir.ibotta.com","name":"https://ir.ibotta.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"28078d71-a6bb-4e02-acc3-900435af8538","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b571b988-ebdf-4701-a9e6-9e17eeb2fefc"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"b571b988-ebdf-4701-a9e6-9e17eeb2fefc"}],"recentChangeFlags":null},{"id":"2e1cd776-77f7-4fff-907c-0a41a3ae7dd4","uri":"https://trust.ibotta.com","name":"https://trust.ibotta.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7c1d3868-4eb0-4199-ad1f-a7f24eff2c32","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2e1cd776-77f7-4fff-907c-0a41a3ae7dd4"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"2e1cd776-77f7-4fff-907c-0a41a3ae7dd4"}],"recentChangeFlags":null},{"id":"11143147-b436-4ea9-9a12-cd5d0300cd41","uri":"","name":"legal.ibotta.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"79822b83-8348-48b5-b5c4-4fb84df943cf","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"11143147-b436-4ea9-9a12-cd5d0300cd41"}],"recentChangeFlags":null},{"id":"6cb03806-b5d5-4387-9cb6-283259e6dd44","uri":"","name":"*dev.ibotta.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"82579120-f38c-4c81-846b-2f590e521c62","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6cb03806-b5d5-4387-9cb6-283259e6dd44"}],"recentChangeFlags":null},{"id":"68d49521-3650-4b32-a704-45dbf84342a7","uri":"https://investors.ibotta.com/","name":"https://investors.ibotta.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"82402c5d-4826-4d14-abac-ff8da849f504","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"68d49521-3650-4b32-a704-45dbf84342a7"}],"recentChangeFlags":null},{"id":"b0264928-3ed8-4517-95a0-5acecdb91fff","uri":null,"name":"http://sampling.ibotta.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e1aa4621-fca3-49c6-93d3-2815f72fb6c3","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b0264928-3ed8-4517-95a0-5acecdb91fff"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[{"id":"84db3509-3b42-48f0-a8fc-ce6d247ea8e1","attachmentPath":"https://bugcrowd.com/engagements/ibotta/attachments/84db3509-3b42-48f0-a8fc-ce6d247ea8e1","name":"Ibotta%20-%20Account%20Linking%20Flow.docx","filename":"Ibotta%20-%20Account%20Linking%20Flow.docx","description":null,"icon":"fileOther","size":13464,"sizeLabel":"13.1 KB","uploadedAt":"28 Oct 2025","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/ibotta/attachments/84db3509-3b42-48f0-a8fc-ce6d247ea8e1"},{"id":"9ca3aebe-1da4-4a6e-b970-c50d28198658","attachmentPath":"https://bugcrowd.com/engagements/ibotta/attachments/9ca3aebe-1da4-4a6e-b970-c50d28198658","name":"Pay%20with%20Ibotta%20Flow.docx","filename":"Pay%20with%20Ibotta%20Flow.docx","description":null,"icon":"fileOther","size":20024,"sizeLabel":"19.6 KB","uploadedAt":"28 Oct 2025","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/ibotta/attachments/9ca3aebe-1da4-4a6e-b970-c50d28198658"},{"id":"4333558a-f571-43c4-a062-2b9e058499e8","attachmentPath":"https://bugcrowd.com/engagements/ibotta/attachments/4333558a-f571-43c4-a062-2b9e058499e8","name":"Pay%20with%20Ibotta%20Video.mp4","filename":"Pay%20with%20Ibotta%20Video.mp4","description":null,"icon":"fileVideo","size":18316627,"sizeLabel":"17.5 MB","uploadedAt":"28 Oct 2025","fileType":"Video","embedUrl":"https://bugcrowd.com/engagements/ibotta/attachments/4333558a-f571-43c4-a062-2b9e058499e8"},{"id":"2585a9c7-3922-4817-a0bc-e79e644bc6cc","attachmentPath":"https://bugcrowd.com/engagements/ibotta/attachments/2585a9c7-3922-4817-a0bc-e79e644bc6cc","name":"pwiFlowAndroid%20(1).mov","filename":"pwiFlowAndroid%20(1).mov","description":null,"icon":"fileVideo","size":18334827,"sizeLabel":"17.5 MB","uploadedAt":"28 Oct 2025","fileType":"Video","embedUrl":"https://bugcrowd.com/engagements/ibotta/attachments/2585a9c7-3922-4817-a0bc-e79e644bc6cc"}],"engagement":{"id":"79c66f97-9c03-4c39-93d1-67223e2d4323","code":"ibotta","state":"in_progress","endsAt":null,"bountyId":"dcfad27f-e1a9-4332-94db-d8d7cbbcbd91","startsAt":"2017-02-09T19:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/9c25/03f5/d73ce457/236a9ad3edc26137acd7df897d9c3235_NEW-Ibotta-Logo-Bug-Crowd.png","logoBackgroundColor":"#5e5e5e","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2017-02-09T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/ibotta","changelogs":"/engagements/ibotta/changelog","submissions":null,"announcements":"/engagements/ibotta/announcements","hallOfFame":"/engagements/ibotta/hall_of_fames","crowdstream":"/engagements/ibotta/crowdstream"},"announcementsCount":22,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/ibotta/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=ibotta\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/ibotta/engagement_subscribers","engagementChangelogsUrl":"/engagements/ibotta/changelog","publishedAt":"2026-04-10T21:01:59.887Z","engagementChangelogUrl":"/engagements/ibotta/changelog/112af3b9-e1ec-486e-855d-e5977ab90908","createUserFeedbacksUrl":"/engagements/ibotta/feedbacks","engagementCrowdstreamUrl":"/engagements/ibotta/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}