{"id":"11945c4b-3351-46c4-8268-782f8c2bf97b","engagementId":"47908948-8b91-428a-9b1e-d71746661f84","data":{"brief":{"id":"eab574c6-ab27-464f-bdbb-bcda39c5508b","name":"Indeed","tagline":"We help people get jobs.","description":"\u003ch1\u003eOur Mission:\u003c/h1\u003e\n\n\u003cp\u003eAt Indeed, our mission is to help people get jobs.\u003c/p\u003e\n\n\u003cp\u003eSince 2004, Indeed has given job seekers free access to millions of jobs from thousands of company websites and job boards. As the leading pay-for-performance recruitment advertising network, Indeed drives millions of targeted applicants to jobs in every field and is the most cost-effective source of candidates for thousands of companies. \u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWe take our security very seriously and welcome any responsible disclosure of potential gaps in our systems.\u003c/strong\u003e Please read through the following details to help you focus on the areas most important to us.\u003c/p\u003e\n\n\u003cp\u003eIndeed, at its discretion, may award an additional reward bonus for exceptional reports. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eTesting Requirement\u003c/h1\u003e\n\n\u003cp\u003eTest using only accounts created with @bugcrowdninja.com email addresses. Additional @bugcrowdninja.com email addresses can be requested using the credential request button at the bottom of this page.\u003c/p\u003e\n\n\u003cp\u003eInclude \u003ccode\u003ebugbounty\u003c/code\u003e in the company title you create and do not attempt to misrepresent yourself as a real company.\u003c/p\u003e\n\n\u003cp\u003eInclude the term \u003ccode\u003ebugbounty\u003c/code\u003e in all text fields including your user agent string. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eProgram Ground Rules\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003eRespect our users' privacy.\u003c/li\u003e\n\u003cli\u003eLeave the Site as you found it.\u003c/li\u003e\n\u003cli\u003eDon't violate our Terms of Service or the law.\u003c/li\u003e\n\u003cli\u003eDon't knowingly impact our services.\u003c/li\u003e\n\u003cli\u003eNo interacting with others.\u003c/li\u003e\n\u003cli\u003eCooperate with Indeed.\u003c/li\u003e\n\u003cli\u003eParticipation Eligibility.\u003c/li\u003e\n\u003cli\u003eFollow Bugcrowd's rules.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eRespect our users’ privacy.\u003c/h3\u003e\n\n\u003cp\u003eIf during your research you happen to encounter any information about another user or other individual, \u003cstrong\u003eimmediately stop and report\u003c/strong\u003e this to Indeed. \u003cstrong\u003eTo participate in this program, you only need to explain the technical vulnerability you discovered.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eYou must avoid any viewing, copying, altering, destroying, or otherwise interacting with any data, in particular data of other individuals, to which you may gain access through this research. If a vulnerability provides unintended access to data, limit the amount of data you access to the minimum required for effectively demonstrating the vulnerability; cease testing, and submit a report immediately if you encounter any user data during testing. This may include Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information.\u003c/p\u003e\n\n\u003ch3\u003eLeave the site as you found it.\u003c/h3\u003e\n\n\u003cp\u003eDo not copy, save, store, transfer, disclose, or otherwise retain any information you find on our site during your research, except to report your research to Indeed.\u003c/p\u003e\n\n\u003ch3\u003eDon't violate our Terms of Service or the law.\u003c/h3\u003e\n\n\u003cp\u003eAll access to our Site must otherwise be in accordance with our Terms of Service and all applicable laws.\u003cbr\u003e\nIn the event you access PII or other sensitive data, note that you are required to follow all laws and regulations applicable to the access and processing of such personally identifiable information and/or data, such as the California Consumer Privacy Act of 2018, the California Privacy Rights Act of 2020,  New York Privacy Act 2021, once they become effective, and the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679), including the European Commission’s Standard Contractual Clauses regarding the transfer of personal data to processors.\u003c/p\u003e\n\n\u003ch3\u003eDon't knowingly impact our services.\u003c/h3\u003e\n\n\u003cp\u003eYou must avoid causing any interruption or degradation of our services. Researchers who are found to be using aggressive automated tools will be blocked and removed from the program.\u003c/p\u003e\n\n\u003cp\u003eWhen testing purchasing services on Indeed, limit any purchase amounts to the minimum necessary and under $10,000.\u003c/p\u003e\n\n\u003ch3\u003eNo interacting with others.\u003c/h3\u003e\n\n\u003cp\u003eAny form of interaction with others on or through our Sites, including but not limited to other Indeed users, is strictly prohibited. On Indeed,close any active test jobs immediately after testing. \u003cstrong\u003eOn Indeed Flex, do not publish any jobs.\u003c/strong\u003e Do not make any attempts to phish users or employees.\u003c/p\u003e\n\n\u003ch3\u003eCooperate with Indeed.\u003c/h3\u003e\n\n\u003cp\u003eYou will be expected to cooperate with us if we request your assistance in connection with your research.\u003c/p\u003e\n\n\u003ch3\u003eParticipation Eligibility.\u003c/h3\u003e\n\n\u003cp\u003eCurrent employees or contractors of Indeed and Indeed Flex are not eligible to participate in the program. Former employees and contractors are eligible to participate in the program only, if:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ethey have left Indeed and Indeed Flex more than 1 year prior to submission, and\u003c/li\u003e\n\u003cli\u003ethey are not making use of, or referring to, any non-public Indeed/Indeed Flex information obtained when they were an employee or contractor.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eFollow Bugcrowd’s rules.\u003c/h3\u003e\n\n\u003cp\u003eThis program follows Bugcrowd’s \u003ca href=\"https://www.bugcrowd.com/resources/hacker-resources/standard-disclosure-terms/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003estandard disclosure terms\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003ch1\u003eSeverity, Rewards \u0026amp; Reporting\u003c/h1\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified using the methodology defined below. In an instance where an issue is downgraded, Indeed will try to provide a detailed explanation to the researcher - along with the opportunity to appeal, and make a case for a higher priority. However, discretion for determining final severity ratings remains with Indeed.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eWhen we are determining \u003cstrong\u003eseverity\u003c/strong\u003e, the following descriptions are not meant to be absolute categorizations. Severity depends on \u003cstrong\u003epotential damage to the business and clients, ease of abuse, how much we can actually fix, size of the user base, and sensitivity of the data.\u003c/strong\u003e Note: A high severity finding on a demo application may be a P4 due to low impact and non-sensitive data.\u003c/p\u003e\n\n\u003cp\u003eWhen we are determining \u003cstrong\u003erewards\u003c/strong\u003e within a severity range, the difference between, for example, a High-P1 ($10,000) and a Low-P1 ($4,000) would depend on the \u003cstrong\u003enumber of prerequisites required\u003c/strong\u003e, the \u003cstrong\u003edifficulty\u003c/strong\u003e, the \u003cstrong\u003eimpact\u003c/strong\u003e and the \u003cstrong\u003elikelihood\u003c/strong\u003e of exploitation.\u003c/p\u003e\n\n\u003cp\u003eFor those reasons, we recommend providing:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eAn attack scenario:\u003c/strong\u003e what is the most likely way an attacker could abuse said vulnerability.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eClear, numbered reproduction steps:\u003c/strong\u003e if we can't easily reproduce what you are describing, we may misinterpret the issue or severity.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eA video Proof of Concept (PoC):\u003c/strong\u003e for more complicated exploits.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eImpact:\u003c/strong\u003e your understanding of the impact to Indeed or its users if an attacker exploits the said vulnerability\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecommended fix:\u003c/strong\u003e if you have any good ideas on ways to mitigate the risk without impacting normal users, it would be appreciated.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIn cases where Indeed has identified the same vulnerability through our internal tools and remediation is in-flight, the reward may be adjusted based on the value of the submission. \u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003e\u003cstrong\u003eSeverity\u003c/strong\u003e\u003c/th\u003e\n\u003cth\u003e\u003cstrong\u003eDescription\u003c/strong\u003e\u003c/th\u003e\n\u003cth\u003e\u003cstrong\u003eExamples\u003c/strong\u003e\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003eP1\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eVulnerabilities on Indeed applications that have the potential to: (1) affect most users, (2) disclose highly sensitive data, or (3) have a high impact on business operations.\u003c/td\u003e\n\u003ctd\u003eRCE on backend systems, authentication bypass leading to account compromise, privilege escalations from unprivileged to Admin or cross-organizational lateral movement, sensitive data exposure of Job Seeker or Employer PII\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003eP2\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eVulnerabilities that have the potential to: (1) affect many users, (2) disclose sensitive data, (3) could lead to reputational or substantial business loss, or(4) affect the security or availability of individual processes or services.\u003c/td\u003e\n\u003ctd\u003eStored XSS, exposed API credentials, subdomain takeovers on *.indeed.com\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003eP3\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eVulnerabilities that can affect multiple or individual users with little to no user interaction, or only have security implications within an organizational context.\u003c/td\u003e\n\u003ctd\u003eReflected XSS, misconfigured CORS.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cem\u003eP4\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eIssues that affect multiple or individual users and may require user interaction or significant prerequisites to exploit. The potential business or user impact is likely low, or sensitivity of the data considered to be low.\u003c/td\u003e\n\u003ctd\u003eURL Redirects, Many Intra-organizational privilege escalations.\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ch3\u003eOut of Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAI Safety issues, getting the chatbot to say bad things is not a Security vulnerability\n\n\u003cul\u003e\n\u003cli\u003eVarious Bias types defined by the VRT: Algorithmic biases, data biases, developer biases, societal biases, misinterpretation biases\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eSandboxed code executions within AI applications\u003c/li\u003e\n\u003cli\u003eMulti-turn AI attack that isn’t reproducible\u003c/li\u003e\n\u003cli\u003eVolumetric/Distributed denial of service attacks against AI-enhanced applications such as Career Scout\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eBugCrowd Vulnerability Rating Taxonomy (VRT) Exceptions\u003c/h3\u003e\n\n\u003cp\u003eSome types of issues do not present a significant enough risk to Indeed, and are usually not accepted. Any submission of these types will only be rewardable if significant risk and impact can be demonstrated.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eIntra-Organizational Broken Access Controls, unless integrity impact is high\u003c/li\u003e\n\u003cli\u003eVulnerabilities dependent on unlikely high privileges (eg. malicious admin)\u003c/li\u003e\n\u003cli\u003eUser enumeration vulnerabilities\u003c/li\u003e\n\u003cli\u003eVolumetric DoS vulnerabilities\u003c/li\u003e\n\u003cli\u003eDebug/Stack trace/Errors with non-secret data\u003c/li\u003e\n\u003cli\u003eRate-limiting vulnerabilities, unless integrity impact is high\u003c/li\u003e\n\u003cli\u003eExternal SSRF\u003c/li\u003e\n\u003cli\u003eInternal SSRF without an impactful proof of concept\u003c/li\u003e\n\u003cli\u003eHTMLi without a realistic and impactful proof of concept\u003c/li\u003e\n\u003cli\u003eSelf-XSS\u003c/li\u003e\n\u003cli\u003e​​Clickjacking on pages with no sensitive data or actions\u003c/li\u003e\n\u003cli\u003eAttacks requiring Man-in-the-Middle or physical access to a user’s device\u003c/li\u003e\n\u003cli\u003eWAF-bypass via Origin IP\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting users of outdated browsers\u003c/li\u003e\n\u003cli\u003eSPF/DMARC/DKIM record missing on a domain\u003c/li\u003e\n\u003cli\u003eSSTI, without impactful proof of concept\u003c/li\u003e\n\u003cli\u003ePublic API schema\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eHelpful Tips For Your Testing\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eDifferent Accounts Types and Roles:\u003c/strong\u003e Job seekers and employer accounts have access to different features and views. You may want to set up test accounts as both. Organizations can have multiple employer accounts, each with different RBAC defined roles. See \u003ca href=\"https://indeed.force.com/employerSupport1/s/article/206589143?language=en_US\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://indeed.force.com/employerSupport1/s/article/206589143?language=en_US\u003c/a\u003e to learn more.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eGroup similar submissions:\u003c/strong\u003e We ask that researchers who are able to identify the same or similar types of issues in multiple locations, across one of our applications combine those findings into a single submission that includes a description as well as the various locations where vulnerabilities have been identified.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eLocalization:\u003c/strong\u003e Indeed is an international company with many different subdomains for different countries, running the same applications in different languages, example: mx.indeed.com, ca.indeed.com, in.indeed.com, vn.indeed.com. Localized versions can share the same codebase and therefore, a vulnerability found on many may only be eligible to be rewarded once.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eThird party applications:\u003c/strong\u003e For third party applications, such as Wordpress, they will only be eligible for reward if there is action Indeed can take to mitigate issues identified, A good example of something we wouldn't payout for is the output of WPScan showing recently out of date plugins, since regular patching is part of our WP management. An example of something we would payout for is a POC showing unintended behavior that isn't in a vendor patch.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDisclosing results:\u003c/strong\u003e This bounty requires explicit permission to disclose the results of a submission.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDocumentation:\u003c/strong\u003e Developer documentation: \u003ca href=\"https://docs.indeed.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.indeed.com/\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eTarget Overview\u003c/h1\u003e\n\n\u003cp\u003eDon’t know where to start? Here is a breakdown of a few different features at Indeed\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003e\u003cstrong\u003eTarget\u003c/strong\u003e\u003c/th\u003e\n\u003cth\u003e\u003cstrong\u003eDescription\u003c/strong\u003e\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eCareer Scout\u003c/td\u003e\n\u003ctd\u003e\n\u003cem\u003eFocus Areas\u003c/em\u003e Prompt injection, insecure output handling. Additionally all vulnerabilities we have in-scope are also relevant to our AI solutions, and we are particularly interested in: Authorization issues, Authentication issues, Sensitive data exposure, Stored or reflected XSS.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://secure.indeed.com\u003c/td\u003e\n\u003ctd\u003eAuthentication services for job seekers and employers accessing Indeed products. \u003cem\u003eFocus areas: Authentication bypass/flaws, Oauth flaws.\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttp://secure.indeed.com/account/apikeys https://developer.indeed.com/ (api documentation)\u003c/td\u003e\n\u003ctd\u003eRegister an application to access Indeed APIs \u003cem\u003eFocus areas: Oauth flaws\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://account.indeed.com\u003c/td\u003e\n\u003ctd\u003eAccess control platform for employers to manage users and permissions across  different Indeed products. \u003cem\u003eFocus areas: broken access control, privilege escalation.\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://profile.indeed.com\u003c/td\u003e\n\u003ctd\u003eProfile and resume creation or upload for Job Seekers. Start testing by going to \u003ca href=\"https://profile.indeed.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://profile.indeed.com\u003c/a\u003e and creating a profile. \u003cem\u003eFocus areas: injection, file upload vulnerabilities\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://employers.indeed.com\u003c/td\u003e\n\u003ctd\u003eThe employer home platform. Post jobs, manage candidates, etc. Many employer-facing applications will be accessible and testable from here. \u003cstrong\u003eGood place to begin testing.\u003c/strong\u003e \u003cem\u003eFocus areas: privilege escalation\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://www.indeed.com  https://www.indeed.com/jobs\u003c/td\u003e\n\u003ctd\u003eJob Search. \u003cem\u003eFocus areas: injection\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://m5.apply.indeed.com\u003c/td\u003e\n\u003ctd\u003eApply for jobs. This application is accessible by clicking on the job “Apply” button. \u003cstrong\u003eRemember to only test your own jobs!\u003c/strong\u003e \u003cem\u003eFocus areas: injection\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://employers.indeed.com/interviews\u003c/td\u003e\n\u003ctd\u003eIndeed Virtual Interviews allows employers and job seekers to conduct virtual interviews on the platform. Start testing by scheduling a video interview with your test candidate and browsing to \u003ca href=\"https://employers.indeed.com/interviews\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://employers.indeed.com/interviews\u003c/a\u003e. \u003cem\u003eFocus areas: privilege escalation, sensitive data exposure\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://apis.indeed.com/graphql\u003c/td\u003e\n\u003ctd\u003eIndeed's federated GraphQL gateway. \u003cem\u003eFocus areas: privilege escalation, sensitive data exposure.\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://billing.indeed.com\u003c/td\u003e\n\u003ctd\u003eThe billing management interface for employers' billing-related interactions. Start testing at \u003ca href=\"https://billing.indeed.com/summary\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://billing.indeed.com/summary\u003c/a\u003e. \u003cem\u003eFocus areas: sensitive data exposure\u003c/em\u003e\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eportal.syftapp.com\u003c/td\u003e\n\u003ctd\u003eUK Employer portal\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eportal.indeedflex.com\u003c/td\u003e\n\u003ctd\u003eUS Employer portal\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eagency.indeedflex.com\u003c/td\u003e\n\u003ctd\u003eAgency portal\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eadmin.indeedflex.com\u003c/td\u003e\n\u003ctd\u003eUS Admin portal\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eadmin.syftapp.com\u003c/td\u003e\n\u003ctd\u003eUK Admin portal\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eindeedflex.com\u003c/td\u003e\n\u003ctd\u003eLanding page\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://play.google.com/store/apps/details?id=com.syftapp.android\u003c/td\u003e\n\u003ctd\u003eAndroid worker app\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://apps.apple.com/gb/app/indeed-flex-job-search/id1013812731\u003c/td\u003e\n\u003ctd\u003eiOS worker app\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://play.google.com/store/apps/details?id=com.indeed.employer.mobile\u0026amp;referrer=utm_source%3Dlandingpage%26anid%3Dadmob\u003c/td\u003e\n\u003ctd\u003eAndroid Indeed Connect App for Employers\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ehttps://apps.apple.com/us/app/indeed-connect-for-employers/id6443822731\u003c/td\u003e\n\u003ctd\u003eiOS Indeed Connect App for Employers\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003e—\u003c/p\u003e\n\n\u003ch1\u003eInstructions for Testing Career Scout\u003c/h1\u003e\n\n\u003col\u003e\n\u003cli\u003eClaim a single jobseeker account from the Career Scout Credential account bucket below\u003c/li\u003e\n\u003cli\u003eInstall and open TestFlight on an iOS device or Apple Computer\u003c/li\u003e\n\u003cli\u003eOpen https://testflight.apple.com/join/veieI9UZ to accept access to the Indeed Jobsearch application within TestFlight\u003c/li\u003e\n\u003cli\u003eLogin to the claimed bugcrowdninja account, either by resetting the password through Forgot Password or by logging in via email\u003c/li\u003e\n\u003cli\u003eClick on the Assist button in the navigation bar\n\u003cimg src=\"https://bugcrowd.com/engagements/indeed/attachments/25b9ad59-c0e8-4e68-a3eb-5f11b77f837e\" title=\"CareerScout.jpeg\" alt=\"CareerScout.jpeg\"\u003e\n\u003c/li\u003e\n\u003c/ol\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"4de4420a-be8c-46aa-86d3-eec6fb726755","name":"Primary Targets","targets":[{"id":"96a7f7d3-bb57-43d5-92d3-bda5482b8355","uri":"https://indeed.com","name":"*.indeed.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"540abdac-8e00-43ee-a3d2-c6be5771ee3e","sortOrder":0},"sortOrder":0,"tags":[{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"96a7f7d3-bb57-43d5-92d3-bda5482b8355"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"96a7f7d3-bb57-43d5-92d3-bda5482b8355"}],"recentChangeFlags":null},{"id":"24039d02-1e6d-4f73-9dea-94604a07a1b5","uri":"","name":"https://*.indeedflex.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8ff95b6e-fa33-499d-bb96-e8e941f54e7c","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"515b12b2-8bb6-4187-bc35-0d4045fe48cb","uri":"","name":"https://apis.indeed.com/graphql","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a9bc1713-8cee-4c39-89c1-645e9c4ac4fe","sortOrder":2},"sortOrder":2,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"515b12b2-8bb6-4187-bc35-0d4045fe48cb"}],"recentChangeFlags":null},{"id":"9b3a53e4-83a7-4153-a383-be1dfe6f3290","uri":"https://play.google.com/store/apps/details?id=com.indeed.android.jobsearch","name":"Indeed Job Search Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8d53b1e2-e14e-471a-a008-75fc2f377443","sortOrder":3},"sortOrder":3,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"9b3a53e4-83a7-4153-a383-be1dfe6f3290"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"9b3a53e4-83a7-4153-a383-be1dfe6f3290"}],"recentChangeFlags":null},{"id":"779a4d0f-ffd8-49c7-b9a6-0cd6be16b4da","uri":"https://apps.apple.com/us/app/indeed-job-search/id309735670","name":"Indeed Job Search iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d6a418d5-a468-4f8a-8512-c2dac056537d","sortOrder":4},"sortOrder":4,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"779a4d0f-ffd8-49c7-b9a6-0cd6be16b4da"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"779a4d0f-ffd8-49c7-b9a6-0cd6be16b4da"}],"recentChangeFlags":null},{"id":"217f1849-b11c-4978-b30e-ca810f303c45","uri":"https://play.google.com/store/apps/details?id=com.syftapp.android","name":"Android Indeed Flex App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5f792563-9128-490b-b3ca-4758e54bea6b","sortOrder":5},"sortOrder":5,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"217f1849-b11c-4978-b30e-ca810f303c45"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"217f1849-b11c-4978-b30e-ca810f303c45"}],"recentChangeFlags":null},{"id":"49907609-bfe4-4e23-8e0a-e0a4d0371ed7","uri":"https://apps.apple.com/gb/app/indeed-flex-job-search/id1013812731","name":"iOS Indeed Flex App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"db6e6c5d-edcc-4202-bda7-2f56789d760a","sortOrder":6},"sortOrder":6,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"49907609-bfe4-4e23-8e0a-e0a4d0371ed7"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"49907609-bfe4-4e23-8e0a-e0a4d0371ed7"}],"recentChangeFlags":null},{"id":"88fd3af2-568d-40be-9613-3694882d48b6","uri":"","name":"Career Scout","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a0de67b7-2f8d-453d-8413-3736e21d8bbe","sortOrder":7},"sortOrder":7,"tags":[{"id":"d14cf1dd-8069-48ef-9a2b-779bf3a066f9","name":"Artificial Intelligence","targetId":"88fd3af2-568d-40be-9613-3694882d48b6"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"88fd3af2-568d-40be-9613-3694882d48b6"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"88fd3af2-568d-40be-9613-3694882d48b6"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"8ac183fe-9e7b-4258-bd8c-21674e531eb6","p1MaxCents":1000000,"p1MinCents":400000,"p2MaxCents":400000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":20000,"p4MaxCents":20000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003e\u003ccode\u003ehttps://*.indeed.com\u003c/code\u003e presents a large attack surface. All subdomains can be considered in-scope in the Primary Target grouping with the exception of those explicitly defined in-scope in the other target groupings or out-of-scope. We leave it to the researcher to discover subdomains not listed here.\u003c/p\u003e","rewardRangeData":{"1":{"min":4000,"max":10000},"2":{"min":1000,"max":4000},"3":{"min":200,"max":1000},"4":{"min":50,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"8c26ab45-f19c-4fad-bd5b-ffc9ab5a2880","name":"Secondary Targets","targets":[{"id":"7fc7663a-b5fc-4ac3-b35a-154b4a629d47","uri":"","name":"https://*.indeed.tech","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d994e809-d835-4a53-b12b-8c566b631bc1","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"9f93e5e6-9cf1-43f3-a0dd-b7af8dcc7dd1","uri":"","name":"https://*.indeed.net","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"61cc65ae-0405-42d8-bc66-e951cb4c12c2","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"46d3ea74-fb4c-4d32-bf17-d513f1a655d1","uri":"https://resume.com","name":"https://resume.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"78cc7bca-1d55-4d4c-8983-7d44037a9a2a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7e10e579-815c-45e2-9512-d8b81ff07427","uri":"https://wowjobs.ca","name":"https://wowjobs.ca","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"04a1c163-a3ff-4873-a46d-25bc97008217","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"0b9239eb-0b0b-4679-8b8e-fa54195eea05","uri":"https://apps.apple.com/us/app/%E5%B1%A5%E6%AD%B4%E6%9B%B8%E4%BD%9C%E6%88%90-%E3%82%A4%E3%83%B3%E3%83%87%E3%82%A3%E3%83%BC%E3%83%89/id1484451230","name":"履歴書作成 (Universal Resume) iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"80bb52a7-7dfa-4742-a9ac-ed0dfc15aa65","sortOrder":0},"sortOrder":0,"tags":[{"id":"7cbdff60-9a91-41df-b802-486d21021b34","name":"ReactNative","targetId":"0b9239eb-0b0b-4679-8b8e-fa54195eea05"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"0b9239eb-0b0b-4679-8b8e-fa54195eea05"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"0b9239eb-0b0b-4679-8b8e-fa54195eea05"}],"recentChangeFlags":null},{"id":"a3ea8d28-3e16-4ad2-9246-1c087fcd1aa2","uri":"https://play.google.com/store/apps/details?id=com.indeed.resume","name":"履歴書作成 (Universal Resume) Android","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cd0e4a8c-c765-4e38-ab4e-373e54b6d213","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"a3ea8d28-3e16-4ad2-9246-1c087fcd1aa2"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"a3ea8d28-3e16-4ad2-9246-1c087fcd1aa2"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"a3ea8d28-3e16-4ad2-9246-1c087fcd1aa2"}],"recentChangeFlags":null},{"id":"f5e96950-ace5-4675-9e29-0fb72113758b","uri":"https://apps.apple.com/us/app/indeed-connect-for-employers/id6443822731","name":"Indeed Connect for Employers","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"de90dc10-9de9-4677-922e-5bd1f2492cdf","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"f5e96950-ace5-4675-9e29-0fb72113758b"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"f5e96950-ace5-4675-9e29-0fb72113758b"}],"recentChangeFlags":null},{"id":"f790c1f0-a605-42b9-b409-d7192c0d010f","uri":"https://chromewebstore.google.com/detail/indeed-recruiter-extensio/kiodpphbmnmcmnfgpnmkkhmkllnlflef","name":"Indeed Recruiter Extension (Chrome)","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ff3cd435-7ac1-4ed3-803b-01c18ee6273c","sortOrder":0},"sortOrder":0,"tags":[{"id":"59791207-9cf4-4498-b5e1-510fee95dc40","name":"Browser Extension","targetId":"f790c1f0-a605-42b9-b409-d7192c0d010f"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"8f502405-b9d9-4c34-9b70-674cafdca39a","p1MaxCents":1000000,"p1MinCents":400000,"p2MaxCents":400000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":20000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":4000,"max":10000},"2":{"min":1000,"max":4000},"3":{"min":200,"max":1000},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"47a4bbbf-a545-425c-8969-72fea39190ee","name":"Other Targets","targets":[{"id":"ed5ed47d-0e63-450b-9b31-efabc9b07070","uri":"","name":"Any host/web property/mobile app verified to be owned by Indeed","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"367402ea-9001-4c6e-b470-47759e3e6379","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"00244e7c-4078-47e4-bad7-5ac25bdb06bd","p1MaxCents":100000,"p1MinCents":null,"p2MaxCents":40000,"p2MinCents":null,"p3MaxCents":20000,"p3MinCents":null,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eAny host/web property/mobile application owned by Indeed in which we can take action to mitigate the issue reported, but is not in scope as a Primary target.\u003c/p\u003e","rewardRangeData":{"1":{"min":0,"max":1000},"2":{"min":0,"max":400},"3":{"min":0,"max":200},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[{"id":"25b9ad59-c0e8-4e68-a3eb-5f11b77f837e","attachmentPath":"https://bugcrowd.com/engagements/indeed/attachments/25b9ad59-c0e8-4e68-a3eb-5f11b77f837e","name":"CareerScout.jpeg","filename":"CareerScout.jpeg","description":null,"icon":"fileImage","size":25332,"sizeLabel":"24.7 KB","uploadedAt":"20 May 2025","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/indeed/attachments/25b9ad59-c0e8-4e68-a3eb-5f11b77f837e"}],"engagement":{"id":"47908948-8b91-428a-9b1e-d71746661f84","code":"indeed","state":"in_progress","endsAt":null,"bountyId":"6cee47f5-0ef7-40f1-87bd-307d675dd598","startsAt":"2015-01-26T10:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/31c9/4eb4/c1f21362/77aca7a0c2e1d0a71ca2a2f404b6c17d_Untitled.png","logoBackgroundColor":"#2763fd","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2015-01-26T10:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/indeed","changelogs":"/engagements/indeed/changelog","submissions":null,"announcements":"/engagements/indeed/announcements","hallOfFame":"/engagements/indeed/hall_of_fames","crowdstream":"/engagements/indeed/crowdstream"},"announcementsCount":28,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/indeed/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=indeed\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/indeed/engagement_subscribers","engagementChangelogsUrl":"/engagements/indeed/changelog","publishedAt":"2025-07-25T16:37:11.003Z","engagementChangelogUrl":"/engagements/indeed/changelog/11945c4b-3351-46c4-8268-782f8c2bf97b","createUserFeedbacksUrl":"/engagements/indeed/feedbacks","engagementCrowdstreamUrl":"/engagements/indeed/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}