{"id":"dfcab525-3b8b-44d9-a36d-461e837ae49a","engagementId":"9fafd595-a074-480a-80c3-43d3ff0be6cf","data":{"brief":{"id":"df32d02e-5c19-4352-b9e7-5a5fe8c03928","name":"iFood: Bug Bounty Program","tagline":"iFood Bug Bounty Program","description":"\u003cp\u003eHey, you! Wanna be part of our cyber food program? So pay attention to how you can deliver vulnerabilities to us! Let the Hunger Games begin!\u003cbr\u003e\nThanks for your interest in the iFood bug bounty program! We're happy you're here. \u003c/p\u003e\n\n\u003cp\u003eOur goal is to set a benchmark for security and we see that ongoing process as a team effort. External security evaluations are an important part of the process and make iFood a better, safer environment. We need researchers who can think creatively and work outside the box to find security bugs. We are committed to working with you to verify, reproduce and respond to legitimate reported vulnerabilities covered by this page. \u003c/p\u003e\n\n\u003cp\u003eIf you have something that you feel is close to exploitation, or if you'd like some information regarding the internals of our systems, or generally have any questions regarding the app that would help in your efforts, please create a submission and ask for that information. iFood will also accept flaw-hypothesis submissions, without penalty, and will work with you to develop a reasonable hypothesis into a working exploit, should one be possible.\u003cbr\u003e\nThis program is exclusively limited to app and web applications listed in this document. Please, take note of the current scope outlined below.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003eThere's no need to reinvent the wheel. The iFood program will use what's best on the market and we hope to improve it over time! For now, we are using the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it's important to note: Sometimes, our analysis team can modify a vulnerability priority due to its likelihood or impact. But fear not, you'll be notified and a detailed explanation will be provided - along with the opportunity to appeal and make a case for a higher priority.\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of iFood not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to iFood, you can report it. However, be aware that it may be ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://researcherdocs.bugcrowd.com/v2.0/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. You may register for accounts here: \u003ca href=\"https://www.ifood.com.br/entrar\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.ifood.com.br/entrar\u003c/a\u003e\u003c/p\u003e\n\n\u003ch2\u003eGeografic Limitations\u003c/h2\u003e\n\n\u003cp\u003eWe are a Brazilian company and we do some blocking for other countries. If you are not in our country, we suggest that you use a proxy with Brazilian geolocation so that your test is not limited and you have a better experience.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eiFood is very interested in vulnerabilities or business logic flaws around user information leakage. \u003c/li\u003e\n\u003cli\u003eiFood is interested in potential vulnerabilities or business logic flaws around their checkout endpoints. \u003c/li\u003e\n\u003cli\u003eiFood is interested in vulnerabilities with financial damage or frauds.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eWhat not to do\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not disclose vulnerabilities to the public or to any third party.\u003c/li\u003e\n\u003cli\u003eDo not perform any testing that causes degradation to iFood's services; e.g., denial of service, or heavily automated scanning.\u003c/li\u003e\n\u003cli\u003eDo not access or make changes to customer accounts.\u003c/li\u003e\n\u003cli\u003eDo not perform social engineering attacks, including phishing.\u003c/li\u003e\n\u003cli\u003eDo not spam.\u003c/li\u003e\n\u003cli\u003eDo not perform any physical attacks.\u003c/li\u003e\n\u003cli\u003eAny lateral movement and post-exploitation past the initial exploitation are forbidden.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eClickjacking on pages with no sensitive actions\u003c/li\u003e\n\u003cli\u003eCross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\u003c/li\u003e\n\u003cli\u003eAttacks requiring MITM or physical access to a user's device.\u003c/li\u003e\n\u003cli\u003ePreviously known vulnerable libraries without a working Proof of Concept.\u003c/li\u003e\n\u003cli\u003eComma Separated Values (CSV) injection without demonstrating a vulnerability.\u003c/li\u003e\n\u003cli\u003eMissing best practices in SSL/TLS configuration.\u003c/li\u003e\n\u003cli\u003eAny activity that could lead to the disruption of our service (DoS).\u003c/li\u003e\n\u003cli\u003eContent spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\u003c/li\u003e\n\u003cli\u003eRate limiting or brute force issues on non-authentication endpoints\u003c/li\u003e\n\u003cli\u003eMissing best practices in Content Security Policy.\u003c/li\u003e\n\u003cli\u003eMissing HttpOnly or Secure flags on cookies\u003c/li\u003e\n\u003cli\u003eMissing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\u003c/li\u003e\n\u003cli\u003eVulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]\u003c/li\u003e\n\u003cli\u003eSoftware version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\u003c/li\u003e\n\u003cli\u003eOpen redirect - unless an additional security impact can be demonstrated\u003c/li\u003e\n\u003cli\u003eIssues that require unlikely user interaction 3rd party services such as analytics and logs are out of the scope (i.e., all hostnames not listed on the program scope list)\u003c/li\u003e\n\u003cli\u003eData or credential leaks from sources that do not originate from a vulnerability in our in-scope products, e.g. scrapped credentials\u003c/li\u003e\n\u003cli\u003eSubdomain-takeovers (temporarily)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003cli\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"baa7e9b1-1367-484f-8f29-5629da542e0f","name":"iFood - Core Assets","targets":[{"id":"b6c9eeaa-2b60-431b-a255-d4c1265c6d88","uri":"https://play.google.com/store/apps/details?id=br.com.brainweb.ifood\u0026hl=pt_BR","name":"iFood Customer Android Application","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"877e3c74-e28a-443f-ad70-4434371b203e","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"b6c9eeaa-2b60-431b-a255-d4c1265c6d88"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"b6c9eeaa-2b60-431b-a255-d4c1265c6d88"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"b6c9eeaa-2b60-431b-a255-d4c1265c6d88"}],"recentChangeFlags":null},{"id":"05d2c6a9-5442-4d14-bd52-c2af471851ae","uri":"https://apps.apple.com/br/app/ifood-pedir-comida-e-mercado/id483017239","name":"iFood Customer iOS Application","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e2995640-f256-47df-aceb-315daece7484","sortOrder":1},"sortOrder":1,"tags":[{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"05d2c6a9-5442-4d14-bd52-c2af471851ae"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"05d2c6a9-5442-4d14-bd52-c2af471851ae"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"05d2c6a9-5442-4d14-bd52-c2af471851ae"}],"recentChangeFlags":null},{"id":"c4a3ebd7-c2eb-4683-8935-94e435a4e45c","uri":"https://www.ifood.com.br","name":"https://www.ifood.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ed479ebd-9bae-4239-932c-adbc783e73d4","sortOrder":2},"sortOrder":2,"tags":[{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"c4a3ebd7-c2eb-4683-8935-94e435a4e45c"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"c4a3ebd7-c2eb-4683-8935-94e435a4e45c"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"c4a3ebd7-c2eb-4683-8935-94e435a4e45c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c4a3ebd7-c2eb-4683-8935-94e435a4e45c"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"c4a3ebd7-c2eb-4683-8935-94e435a4e45c"}],"recentChangeFlags":null},{"id":"bfa2ea77-6028-4e55-94be-f35d56fdfd5a","uri":"https://marketplace.ifood.com.br","name":"https://marketplace.ifood.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"dd365db4-446b-432f-8e14-1df5af344055","sortOrder":3},"sortOrder":3,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"bfa2ea77-6028-4e55-94be-f35d56fdfd5a"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"bfa2ea77-6028-4e55-94be-f35d56fdfd5a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bfa2ea77-6028-4e55-94be-f35d56fdfd5a"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"bfa2ea77-6028-4e55-94be-f35d56fdfd5a"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"bfa2ea77-6028-4e55-94be-f35d56fdfd5a"}],"recentChangeFlags":null},{"id":"a87c3a06-13fe-4c82-b4da-b1db9e8eca2c","uri":"https://gestordepedidos.ifood.com.br","name":"Gestor de pedidos - Web ONLY","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"17e482bd-982a-4f76-bedf-ba095bb7c7f9","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a87c3a06-13fe-4c82-b4da-b1db9e8eca2c"}],"recentChangeFlags":null},{"id":"49431643-7de4-46d9-86be-73fdf24d8423","uri":"https://wsloja.ifood.com.br","name":"https://wsloja.ifood.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4c43d511-eb70-4df4-969b-d2307c83522a","sortOrder":6},"sortOrder":6,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"49431643-7de4-46d9-86be-73fdf24d8423"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"49431643-7de4-46d9-86be-73fdf24d8423"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"49431643-7de4-46d9-86be-73fdf24d8423"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"49431643-7de4-46d9-86be-73fdf24d8423"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"49431643-7de4-46d9-86be-73fdf24d8423"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"1e617d88-26c5-4afd-8d2b-9f330a576be3","p1MaxCents":375000,"p1MinCents":210000,"p2MaxCents":187500,"p2MinCents":100000,"p3MaxCents":90000,"p3MinCents":45000,"p4MaxCents":40000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eiFood is a leading food delivery platform in Latin America, offering a seamless experience for users to order meals from a wide range of restaurants via its app or website. Beyond food delivery, iFood has expanded into financial services with iFood Pago, providing solutions for partner restaurants and couriers. The targets for the engagement covers the breadth of the https://ifood.com.br web applications. Some domains are excluded and listed as out of scope due to them being developer environments or managed by third party services.\u003c/p\u003e\n\n\u003ch3\u003eInstructions:\u003c/h3\u003e\n\n\u003cp\u003eWhen entering \u003ca href=\"https://www.ifood.com.br\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.ifood.com.br\u003c/a\u003e, iFood Customer iOS Application, iFood Customer Android Application.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eEnter \u0026quot;\u003cem\u003eTravessa Bujari (Bujari - State of Acre, Brazil)\u003c/em\u003e\u0026quot; as your current address with any number.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eYou should be able to see 2 restaurants: \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eOrders on these restaurants won\u0026#39;t be charged or concluded but it\u0026#39;s a good way to test our flow.\u003c/li\u003e\n\u003cli\u003eThe front end of the web applications are primarily JavaScript based, with either Node.js or React. The backend of the applications are \nprimarily written in Java, with some Spring framework included as well as some Golang.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eThe Android applications are completely written in Kotlin and the iOS are written in Swift.\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eiFood consumer app for Android: \u003ca href=\"https://play.google.com/store/apps/details?id=br.com.brainweb.ifood\u0026hl=pt_BR\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://play.google.com/store/apps/details?id=br.com.brainweb.ifood\u0026amp;hl=pt_BR\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eiFood consumer app for iOS: \u003ca href=\"https://apps.apple.com/br/app/ifood-pedir-comida-e-mercado/id483017239\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://apps.apple.com/br/app/ifood-pedir-comida-e-mercado/id483017239\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":2100,"max":3750},"2":{"min":1000,"max":1875},"3":{"min":450,"max":900},"4":{"min":150,"max":400},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"f8cc1210-1102-435d-9b72-c530feddb90c","name":"iFood - Secondary Assets","targets":[{"id":"992aa640-99a3-4a27-9b54-29288ccf6562","uri":"https://*.movilepay.com","name":"*.movilepay.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6de56c35-231f-4ea9-a41e-72cd3a84b74c","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"1646f0f3-d6d5-4b67-a6db-5dea3d7f7d44","uri":"https://*.movilepay.com.br","name":"*.movilepay.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4da882e2-4454-42b7-835b-ca254a4f2874","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"bb2134ab-444b-4639-87c0-8c4960227f64","uri":"https://shop.ifood.com.br","name":"https://shop.ifood.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"65eeac1d-07f9-4f62-93fb-5d3a66156948","sortOrder":2},"sortOrder":2,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"bb2134ab-444b-4639-87c0-8c4960227f64"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bb2134ab-444b-4639-87c0-8c4960227f64"}],"recentChangeFlags":null},{"id":"493a8c2a-1afe-40c0-81bd-a6664081f989","uri":"https://static-images.ifood.com.br","name":"https://static-images.ifood.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6de06e31-a16a-4d9b-98da-960c7b34ee84","sortOrder":3},"sortOrder":3,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"493a8c2a-1afe-40c0-81bd-a6664081f989"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"493a8c2a-1afe-40c0-81bd-a6664081f989"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"493a8c2a-1afe-40c0-81bd-a6664081f989"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"493a8c2a-1afe-40c0-81bd-a6664081f989"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"493a8c2a-1afe-40c0-81bd-a6664081f989"}],"recentChangeFlags":null},{"id":"1912fab2-f8ef-4ecd-bbb9-df930b869a49","uri":"https://developer.ifood.com.br","name":"https://developer.ifood.com.br","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9eeaa685-e8fe-49f6-a7c0-4e6e4a537157","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1912fab2-f8ef-4ecd-bbb9-df930b869a49"}],"recentChangeFlags":null},{"id":"fa7a46e9-7264-479f-8d83-00c14cc1d8c5","uri":"https://api.fstr.rocks","name":"https://api.fstr.rocks","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"509a4fb2-9294-4be5-a3bd-ef14fe134038","sortOrder":5},"sortOrder":5,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"fa7a46e9-7264-479f-8d83-00c14cc1d8c5"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fa7a46e9-7264-479f-8d83-00c14cc1d8c5"}],"recentChangeFlags":null},{"id":"91c0d936-f942-42ae-93d6-058ada3c7443","uri":"https://rc.fstr.rocks","name":"https://rc.fstr.rocks","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"600a33a4-54e7-44c2-8500-313c7d057c98","sortOrder":6},"sortOrder":6,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"91c0d936-f942-42ae-93d6-058ada3c7443"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"91c0d936-f942-42ae-93d6-058ada3c7443"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"b406db1d-2bcf-452b-aeab-51f79047bc0d","p1MaxCents":250000,"p1MinCents":210000,"p2MaxCents":125000,"p2MinCents":100000,"p3MaxCents":60000,"p3MinCents":45000,"p4MaxCents":20000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2100,"max":2500},"2":{"min":1000,"max":1250},"3":{"min":450,"max":600},"4":{"min":150,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"a81cbff0-a09d-4123-b565-5592ae723afe","name":"iFood Pago - Core Assets","targets":[{"id":"4de3d6d2-ff8a-45df-8891-dd0a7fc99eab","uri":"https://www.zoop.com.br","name":"*.zoop.com.br","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"189bd24d-b18c-4299-82bd-08e0a6087202","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"cd8fbd15-44f0-4776-b717-a5651dff0490","uri":"https://www.zoop.ws","name":"*.zoop.ws","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8b9f1cab-a2a4-4109-992d-1b3ca7b40f21","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cd8fbd15-44f0-4776-b717-a5651dff0490"}],"recentChangeFlags":null},{"id":"c2ec4d99-de7d-4fdf-bf17-c31b32af65b3","uri":"https://www.minhaconta.zoop.com.br","name":"Minha Conta Zoop (*.minhaconta.zoop.com.br)","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"21c53e6a-7005-4757-99ad-f24f7939770f","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c2ec4d99-de7d-4fdf-bf17-c31b32af65b3"}],"recentChangeFlags":null},{"id":"d79df975-ec28-48e4-84c5-9f22a688fa29","uri":"https://dash.zoop.com.br/","name":"*.dash.zoop.com.br","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9eb1a3d8-ae11-43c0-b9ed-327f24b1f822","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d79df975-ec28-48e4-84c5-9f22a688fa29"}],"recentChangeFlags":null},{"id":"09785df5-369a-4d31-a3bc-d42b7dda790c","uri":"https://contadigital.ifoodpago.com.br/","name":"Internet Banking (contadigital.ifoodpago.com.br/)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"94f2984c-c639-4f10-b522-7975441215a7","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"09785df5-369a-4d31-a3bc-d42b7dda790c"}],"recentChangeFlags":null},{"id":"72c8679c-8cd1-4a07-9a1e-81f86ab9097a","uri":"https://play.google.com/store/apps/details?id=br.com.movilepay.banking.application\u0026hl=pt_BR","name":"Conta Digital (https://play.google.com/store/apps/details?id=br.com.movilepay.banking.application\u0026hl=pt_BR)","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b5e62249-8a29-4e16-b511-0f1c32792f25","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"72c8679c-8cd1-4a07-9a1e-81f86ab9097a"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"1e617d88-26c5-4afd-8d2b-9f330a576be3","p1MaxCents":375000,"p1MinCents":210000,"p2MaxCents":187500,"p2MinCents":100000,"p3MaxCents":90000,"p3MinCents":45000,"p4MaxCents":40000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2100,"max":3750},"2":{"min":1000,"max":1875},"3":{"min":450,"max":900},"4":{"min":150,"max":400},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"ecf10676-7eeb-4c0d-ac48-b004b36c17ee","name":"iFood Pago - Secondary Assets","targets":[{"id":"57db8155-57c0-4f4b-8722-d04fceea841a","uri":"https://portal.iFoodpago.com.br","name":"Portal iFood Pago (portal.iFoodpago.com.br)","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"59f0fec5-30e5-466b-b850-415f2bcad36f","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"57db8155-57c0-4f4b-8722-d04fceea841a"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":{"id":"b406db1d-2bcf-452b-aeab-51f79047bc0d","p1MaxCents":250000,"p1MinCents":210000,"p2MaxCents":125000,"p2MinCents":100000,"p3MaxCents":60000,"p3MinCents":45000,"p4MaxCents":20000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2100,"max":2500},"2":{"min":1000,"max":1250},"3":{"min":450,"max":600},"4":{"min":150,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"0ac4af61-0ba1-4e31-9100-f8a474794f39","name":"Out of Scope","targets":[{"id":"de6cdfbb-b40a-43f5-b32e-86d8490779a9","uri":"","name":"blog-empresas.ifood.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"355fd862-9297-455c-9131-abeb1b414a52","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"50ee1b82-72a6-49fc-a3df-6a9a9bdead85","uri":"","name":"blog-parceiros.ifood.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8a0618b9-d3ca-41dc-930b-aa84182905a2","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7eadccf8-8ca4-4124-8501-5cd8f87ed5bd","uri":"","name":"*.ecomanda.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"aaf64028-1df5-4233-ad6d-bbca483d96e8","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"781c3616-32af-4544-a6f3-51a5b3882672","uri":"","name":"*.ecomanda.app","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0c8dbcd7-34f4-45d8-bf4b-888d7f03a3aa","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"127b9cd9-0eba-42f6-95b3-a1e7b4c83d1d","uri":"","name":"*.allin.movilepay.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d3e3b50d-e296-4560-902a-1b71abe798fd","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"0721a330-b1d0-42dc-ba11-b4a81c20a2dc","uri":"","name":"*.starsoft.movilepay.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"72dce2b0-8da0-482b-9d78-68a2379ca78e","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"68ba9f7a-9369-49aa-8bd8-af1286027199","uri":"","name":"Gestor de Pedidos - Desktop Client","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b0f0e243-b201-4d84-9e17-fc503c8d41fb","sortOrder":0},"sortOrder":0,"tags":[{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"68ba9f7a-9369-49aa-8bd8-af1286027199"}],"recentChangeFlags":null},{"id":"079dd3ad-5f48-4033-8037-b2e522720720","uri":null,"name":"*.openfinance.ifood.com.br","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b9e3256b-e4f9-4216-8c53-98d61a023a8c","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null},{"id":"ea3d0192-3fdf-4604-a5f1-68d1b736e9fc","uri":"","name":"*.openfinance.ifoodpago.com.br","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ff5ec9d9-4627-4c30-a325-bca1f95c49e7","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":4,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"9fafd595-a074-480a-80c3-43d3ff0be6cf","code":"ifood-og","state":"in_progress","endsAt":null,"bountyId":"bbf2ba2a-0ee0-4625-a24f-caeaf416902c","startsAt":"2020-08-25T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/5b61/d7ed/245b6660/31ff1f5890123a859debb9277cb4a64a_ifood.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-08-25T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/ifood-og","changelogs":"/engagements/ifood-og/changelog","submissions":null,"announcements":"/engagements/ifood-og/announcements","hallOfFame":"/engagements/ifood-og/hall_of_fames","crowdstream":"/engagements/ifood-og/crowdstream"},"announcementsCount":12,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/ifood-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=ifood-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/ifood-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/ifood-og/changelog","publishedAt":"2026-03-06T11:41:56.668Z","engagementChangelogUrl":"/engagements/ifood-og/changelog/dfcab525-3b8b-44d9-a36d-461e837ae49a","createUserFeedbacksUrl":"/engagements/ifood-og/feedbacks","engagementCrowdstreamUrl":"/engagements/ifood-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}