{"id":"07ed7406-2567-4c09-b700-f5783aea7d36","engagementId":"dd07e259-c5ae-4a35-8912-6ae6a251460b","data":{"brief":{"id":"e5468d71-f3f4-4e96-b71b-46d442d45b9a","name":"Intercom","tagline":"A fundamentally new way to communicate with your customers. Intercom is one place for every team in an internet business to communicate with customers, personally, at scale—on your website, inside web and mobile apps, and by email.","description":"\u003cp\u003eWe appreciate all security concerns brought forth and are constantly striving to keep on top of the latest threats. Being pro-active rather than re-active to emerging security issues is a fundamental belief at Intercom. Every day new security issues and attack vectors are created. Intercom strives to keep abreast on the latest state-of-the-art security developments by working with security researchers and companies. We appreciate the community's efforts in creating a more secure world.\u003c/p\u003e\n\n\u003ch3\u003eRewards:\u003c/h3\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eIntercom will rely on the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for prioritization of findings- but reserve the right to either downgrade or upgrade findings’ severity based on the criticality of their underlying risk to Intercom. Appropriate payouts will then be awarded accordingly. Any downgraded submission with come with a full and detailed explanation.\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003cp\u003eAll other domains/end-points other than those listed in the targets section, are out of scope.\u003c/p\u003e\n\n\u003ch3\u003eTarget info:\u003c/h3\u003e\n\n\u003chr\u003e\n\n\u003cul\u003e\n\u003cli\u003eFin AI Agent: \u003ca href=\"https://www.intercom.com/help/en/articles/7120684-fin-ai-agent-explained\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.intercom.com/help/en/articles/7120684-fin-ai-agent-explained\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eiOS IPA and Android SDK available here: \u003ca href=\"https://docs.intercom.com/install-on-your-product-or-site/quick-install/install-and-configure-intercom-on-your-mobile-app\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.intercom.com/install-on-your-product-or-site/quick-install/install-and-configure-intercom-on-your-mobile-app\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eAPI Documentation: \u003ca href=\"https://developers.intercom.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developers.intercom.com/\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eMost recent features added to the product: \u003ca href=\"https://www.intercom.com/changes/en\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.intercom.com/changes/en\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eThe target URLs are the same as those used by our real customers, please keep this in mind and act accordingly.\u003c/li\u003e\n\u003cli\u003eAvoid creating a nuisance to Intercom's customers as much as possible. This includes among other things testing Messenger security by sending payloads to real customers; instead set up your own Intercom account, and your own Messenger installation.\nup (removing those posts) should be done.\u003c/li\u003e\n\u003cli\u003eAutomated vulnerability scans are strictly prohibited.\u003c/li\u003e\n\u003cli\u003eNo attacks against Intercom's existing user base.\u003c/li\u003e\n\u003cli\u003eNo DDoS attacks\u003c/li\u003e\n\u003cli\u003eThis is Intercom's primary production environment. We accept valid PoCs of app-level Denial of Service vulnerabilities but PoCs that intentionally stress or risks the availability of our services will be considered an abuse\u003c/li\u003e\n\u003cli\u003eCreate your own Intercom accounts (likely two, at least - for cross-org testing) to perform research against this app.\u003c/li\u003e\n\u003cli\u003eDo not create more than 4 apps as part of your testing. Failure to comply may result in your account being blacklisted, thanks!\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eNotes on Permission / Paywall Bypasses\u003c/h3\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eIntercom follows a shared security model. Intercom workspace owners are advised to exercise caution when inviting contributors to their workspaces. While Intercom provides \u003ca href=\"https://www.intercom.com/help/en/articles/176-teammate-permissions-how-to-control-workspace-access\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003evarious user permissions\u003c/a\u003e that can help restrict access to certain high-risk operations, these permissions serve as a secondary layer of defense. The primary safeguard is ensuring that invited users are trusted. Therefore:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePermission Bypasses occurring within a single workspace will be assigned a priority of \u003cstrong\u003eP3 or lower\u003c/strong\u003e.\u003c/li\u003e\n\u003cli\u003eA \u003cstrong\u003eP3 priority\u003c/strong\u003e will only be given to Permission Bypasses that have a significant impact on end-user privacy or data, typically involving access to conversation data and/or users' PII or profile information.\u003c/li\u003e\n\u003cli\u003eAll other \u003cstrong\u003ePermission Bypasses\u003c/strong\u003e, excluding Paywall Bypasses, will be categorized as \u003cstrong\u003eP5 Informational\u003c/strong\u003e for triage and rewards.\u003c/li\u003e\n\u003cli\u003eA \u003cstrong\u003ePaywall Bypass\u003c/strong\u003e refers to a bug that allows Intercom users to access \u003cstrong\u003efeatures\u003c/strong\u003e that would normally require an upgraded paid plan. These reports are not accepted, as they do not impact our users.\u003c/li\u003e\n\u003cli\u003eThe guidelines outlined above are intended to set expectations for researchers. However, we reserve the right to make exceptions when evaluating specific reports—we may adjust the priority up or down or even reject a report entirely. That said, in practice, we have consistently adhered to these rules over many years of handling Permission Bypass reports. As a result, deviations from these guidelines in triage outcomes should be considered highly unusual.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eHow to sign up for an Intercom account / app:\u003c/h3\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eIntercom currently offers two primary trial paths, both of which create Intercom workspaces that are in scope for this program:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eFin AI Agent on your current helpdesk\u003c/li\u003e\n\u003cli\u003eThe Intercom Suite\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cimg src=\"https://bugcrowd.com/engagements/intercom/attachments/67938b31-9fcd-4652-a48e-3ade57d66679\" title=\"Screenshot%202026-03-10%20at%2017.19.12.png\" alt=\"Screenshot%202026-03-10%20at%2017.19.12.png\"\u003e\u003c/p\u003e\n\n\u003cp\u003eTo sign up:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eGo to \u003ca href=\"https://app.intercom.com/a/start?security_researcher=true\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://app.intercom.com/a/start?security_researcher=true\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eUse your Bugcrowd email address (username@bugcrowdninja.com). Failure to do so will result in your account being terminated with no reward granted for any valid found bug.\u003c/li\u003e\n\u003cli\u003eTo add a teammate, go to \u003ca href=\"https://app.intercom.com/a/apps/_/settings/teammates/invite\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://app.intercom.com/a/apps/_/settings/teammates/invite\u003c/a\u003e and add their email address to issue an invite. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eFocus Areas:\u003c/h3\u003e\n\n\u003chr\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://genai.owasp.org/llm-top-10/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOWASP Top 10 for LLMs and Gen AI Apps\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCross site scripting (XSS), including those blocked by our Content Security Policy (CSP)\u003c/li\u003e\n\u003cli\u003eCross site request forgery on critical actions\u003c/li\u003e\n\u003cli\u003eRemote code execution / shell injection\u003c/li\u003e\n\u003cli\u003eAuthentication bypass\u003c/li\u003e\n\u003cli\u003eSQL injection\u003c/li\u003e\n\u003cli\u003eInsecure direct object references\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Intercom not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Intercom, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"3ef4797b-d5d7-45a5-90e9-8bb48af8e83b","name":"Default","targets":[{"id":"4720d6e0-6a5a-4c29-abdf-95d6a63bb45f","uri":"https://developers.intercom.com/installing-intercom/docs/about-the-sdk-ios","name":"iOS SDK","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c7f0be31-1376-4b4b-a825-91a2d67beca5","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"4720d6e0-6a5a-4c29-abdf-95d6a63bb45f"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"4720d6e0-6a5a-4c29-abdf-95d6a63bb45f"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"4720d6e0-6a5a-4c29-abdf-95d6a63bb45f"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"4720d6e0-6a5a-4c29-abdf-95d6a63bb45f"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"4720d6e0-6a5a-4c29-abdf-95d6a63bb45f"}],"recentChangeFlags":null},{"id":"b7ed67cf-f597-4f31-9b0b-962069c3f9c7","uri":"https://api.intercom.com","name":"https://api.intercom.io","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a5eb9934-4410-4343-a385-3ef4d8d049ef","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"b7ed67cf-f597-4f31-9b0b-962069c3f9c7"}],"recentChangeFlags":null},{"id":"f518cc1d-3401-4ad0-8e43-350a08d111ce","uri":"https://app.intercom.com","name":"https://app.intercom.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9aad9003-0bdc-49e1-bcfd-c45d5ee5d40c","sortOrder":0},"sortOrder":0,"tags":[{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"f518cc1d-3401-4ad0-8e43-350a08d111ce"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f518cc1d-3401-4ad0-8e43-350a08d111ce"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"f518cc1d-3401-4ad0-8e43-350a08d111ce"}],"recentChangeFlags":null},{"id":"ecfcf108-3180-4702-9941-ca567119a797","uri":null,"name":"*.intercomassets.com / *.intercomcdn.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e22866f8-982b-45b6-a48a-bd60cce4cfad","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"04831bac-94f8-45c7-b3e4-ad11d0716bdc","uri":"https://app.intercom.io/","name":"https://app.intercom.io","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"45c3fdcf-52ab-42e1-9073-17417edb0ac9","sortOrder":0},"sortOrder":0,"tags":[{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"04831bac-94f8-45c7-b3e4-ad11d0716bdc"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"04831bac-94f8-45c7-b3e4-ad11d0716bdc"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"04831bac-94f8-45c7-b3e4-ad11d0716bdc"}],"recentChangeFlags":null},{"id":"4e30c3bb-8c2f-49a6-8cea-6bd83b7ae2c7","uri":"https://developers.intercom.com/installing-intercom/docs/about-the-sdk-android","name":"Android SDK","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"af545f81-2884-4d8d-a70f-ab514d059dc5","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"4e30c3bb-8c2f-49a6-8cea-6bd83b7ae2c7"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"4e30c3bb-8c2f-49a6-8cea-6bd83b7ae2c7"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"4e30c3bb-8c2f-49a6-8cea-6bd83b7ae2c7"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"4e30c3bb-8c2f-49a6-8cea-6bd83b7ae2c7"}],"recentChangeFlags":null},{"id":"d8d5f297-b397-490d-be2d-7e697a9d9003","uri":"https://www.intercom.com/","name":"https://www.intercom.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2c004759-3dc0-4c3e-836a-43115a7d6d58","sortOrder":0},"sortOrder":0,"tags":[{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"d8d5f297-b397-490d-be2d-7e697a9d9003"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"d8d5f297-b397-490d-be2d-7e697a9d9003"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d8d5f297-b397-490d-be2d-7e697a9d9003"}],"recentChangeFlags":null},{"id":"c5ba3967-24b8-4c2d-9531-103b75e95632","uri":"http://mcp.intercom.com","name":"mcp.intercom.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7dd611d9-1780-41e8-80ce-425e73ec263d","sortOrder":7},"sortOrder":7,"tags":[{"id":"785c5b22-9fbd-4f54-83f0-336e4e417b17","name":"Large Language Model","targetId":"c5ba3967-24b8-4c2d-9531-103b75e95632"}],"recentChangeFlags":null},{"id":"1f40e7e0-68a9-4c3f-a7ac-da1fc5b8e74d","uri":"https://api-iam.intercom.io","name":"https://api-iam.intercom.io","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"56552acb-c958-421b-b8dd-bb800dc4e557","sortOrder":8},"sortOrder":8,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"1f40e7e0-68a9-4c3f-a7ac-da1fc5b8e74d"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"1f40e7e0-68a9-4c3f-a7ac-da1fc5b8e74d"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"1f40e7e0-68a9-4c3f-a7ac-da1fc5b8e74d"}],"recentChangeFlags":null},{"id":"272e0eea-2dd2-47de-98e6-4175336a3973","uri":"https://*.mobile-messenger.intercom.com","name":"https://*.mobile-messenger.intercom.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"86ca7346-9274-4406-bc80-6b512af04338","sortOrder":9},"sortOrder":9,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"272e0eea-2dd2-47de-98e6-4175336a3973"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"272e0eea-2dd2-47de-98e6-4175336a3973"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"272e0eea-2dd2-47de-98e6-4175336a3973"}],"recentChangeFlags":null},{"id":"2d21a5c6-591b-447f-b589-879192d90d15","uri":"https://fin.ai/","name":"fin.ai","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a2f4f438-86eb-4d38-a183-0d86f296fc6c","sortOrder":10},"sortOrder":10,"tags":[{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"2d21a5c6-591b-447f-b589-879192d90d15"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"2d21a5c6-591b-447f-b589-879192d90d15"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2d21a5c6-591b-447f-b589-879192d90d15"}],"recentChangeFlags":null},{"id":"a3711207-0557-47a4-9b63-fc34132af12c","uri":"https://app.fin.ai/","name":"https://app.fin.ai/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6767bdef-d42f-4fcd-8cf1-31881a1246dd","sortOrder":11},"sortOrder":11,"tags":[{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"a3711207-0557-47a4-9b63-fc34132af12c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a3711207-0557-47a4-9b63-fc34132af12c"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"a3711207-0557-47a4-9b63-fc34132af12c"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"4255baf1-f4a8-44c2-aa6b-99de3344f323","p1MaxCents":600000,"p1MinCents":600000,"p2MaxCents":300000,"p2MinCents":300000,"p3MaxCents":90000,"p3MinCents":90000,"p4MaxCents":30000,"p4MinCents":30000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":6000,"max":6000},"2":{"min":3000,"max":3000},"3":{"min":900,"max":900},"4":{"min":300,"max":300},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[{"id":"67938b31-9fcd-4652-a48e-3ade57d66679","attachmentPath":"https://bugcrowd.com/engagements/intercom/attachments/67938b31-9fcd-4652-a48e-3ade57d66679","name":"Screenshot%202026-03-10%20at%2017.19.12.png","filename":"Screenshot%202026-03-10%20at%2017.19.12.png","description":null,"icon":"fileImage","size":33123,"sizeLabel":"32.3 KB","uploadedAt":"10 Mar 2026","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/intercom/attachments/67938b31-9fcd-4652-a48e-3ade57d66679"}],"engagement":{"id":"dd07e259-c5ae-4a35-8912-6ae6a251460b","code":"intercom","state":"in_progress","endsAt":null,"bountyId":"416438b7-8333-4e83-a8bb-63978f90015a","startsAt":"2017-02-16T10:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/b31a/9c14/6b4f88c9/94e5e6c80fdbb1522ee3f4ee3bdd2a0b_Intercom_Logo_Mark_White.png","logoBackgroundColor":"#2e92e8","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2017-02-16T10:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/intercom","changelogs":"/engagements/intercom/changelog","submissions":null,"announcements":"/engagements/intercom/announcements","hallOfFame":"/engagements/intercom/hall_of_fames","crowdstream":"/engagements/intercom/crowdstream"},"announcementsCount":18,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"P1 24/7","submitReportUrl":"/engagements/intercom/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=intercom\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/intercom/engagement_subscribers","engagementChangelogsUrl":"/engagements/intercom/changelog","publishedAt":"2026-03-12T09:57:02.002Z","engagementChangelogUrl":"/engagements/intercom/changelog/07ed7406-2567-4c09-b700-f5783aea7d36","createUserFeedbacksUrl":"/engagements/intercom/feedbacks","engagementCrowdstreamUrl":"/engagements/intercom/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}