{"id":"b592ed3f-dd99-4a12-97c8-247fe274c671","engagementId":"2ec278bf-c5e8-4337-9f2d-df06667bd921","data":{"brief":{"id":"9243e24c-9c21-4d7d-b8e3-bb551a5b6a66","name":"Jora","tagline":"Help Secure Jora","description":"\u003cp\u003eFor this program, we're inviting researchers to test Jora's web applications and services - with a focus of identifying security weaknesses that might lead to the compromise of our customer data (mainly, job seekers profiles and resumes).\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eIMPORTANT: Please remember to follow the job posting rules outlined in the program brief.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eThank you for participating!\u003c/p\u003e\n\n\u003ch3\u003eRatings/Rewards:\u003c/h3\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that a vulnerability priority will be modified due to its likelihood and impact. In any instance where an issue is downgraded, Jora will provide a reasonable justification to the researcher.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eTo maximize your reward and payout time frame, please make sure to include the following in your report:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eAn attack scenario\u003c/strong\u003e: What is the most likely way an attacker could abuse this vulnerability?\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eClear reproduction steps\u003c/strong\u003e: If we can't easily replicate what you are describing, we may not consider the issue as serious.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecommended fix\u003c/strong\u003e: If you have any good ideas on ways to mitigate the risk without impacting normal users, your submission will have more value.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eTriage SLA\u003c/h3\u003e\n\n\u003cp\u003eFor P1/P2 issues, we aim to complete our triage within one business week of the issue being reported. For other issues, it may take us up to three business weeks to triage the issue.\u003c/p\u003e","industryTagId":"0def401b-0941-4302-b6d6-5f49469b8ca5","targetsOverview":"\u003cp\u003e\u003cem\u003eAny domain/property of Jora not listed in the targets section is out of scope. This includes any/all subdomains not listed above as well as Jora Local.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eAccess\u003c/h3\u003e\n\n\u003cp\u003ePlease sign up for accounts on \u003ccode\u003ehttps://www.jora.com/\u003c/code\u003e using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://researcherdocs.bugcrowd.com/v2.0/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eRules for posting a job\u003c/h3\u003e\n\n\u003cp\u003eWhen posting jobs on Jora only post jobs using the following details:\u003c/p\u003e\n\n\u003cp\u003eJob Title (must contain): \"Bugcrowd - Do Not Apply\"\u003cbr\u003e\nCountry: United States\u003cbr\u003e\nBusiness address: 1 Coyote Rd, Teller, Alaska, USA\u003cbr\u003e\nEmail: Your \u003ccode\u003e@bugcrowdninja.com\u003c/code\u003e address\u003c/p\u003e\n\n\u003cp\u003eDO NOT post jobs into other regions. Jobs posted within United States will be available on the regional Jora sites.\u003c/p\u003e\n\n\u003ch3\u003eFocus areas\u003c/h3\u003e\n\n\u003cp\u003eWe are most interested in critical vulnerabilities that allow access to customer PII data (user's profile's and CV's) or Jora corporate data and access to Jora's internal network. Jora includes regionally branded sites (e.g. https://au.jora.com/ or https://us.jora.com/), these all share the same underlying deployment/code and thus will be treated as one site.\u003c/p\u003e\n\n\u003ch3\u003eRules \u0026amp; Out of Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eDO NOT\u003c/strong\u003e interact or affect existing customers during testing. This includes things like posting a job not using the instructions above, which could result in real customers applying for your test job ads!!\u003c/li\u003e\n\u003cli\u003eAutomated vulnerability scanning tools are strictly prohibited.\u003c/li\u003e\n\u003cli\u003eJora regularly blocks attacks from users performing suspicious activity. All email addresses belonging to researchers should be your @bugcrowdninja.com.\u003c/li\u003e\n\u003cli\u003eWe do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human input will be rejected.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eExclusions\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eCookie flags, i.e. Secure and HTTPOnly.\u003c/li\u003e\n\u003cli\u003eVolume related issues, i.e. brute-force, rate-limiting, and denial of service.\u003c/li\u003e\n\u003cli\u003eEmail configuration, i.e. SPF, DKIM, and DMARC.\u003c/li\u003e\n\u003cli\u003eError pages, i.e. verbose error messages, stack traces, and invalid status codes.\u003c/li\u003e\n\u003cli\u003eAdmin or maintenance pages, i.e. monitoring system login pages, and pages with no sensitive information.\u003c/li\u003e\n\u003cli\u003eClickjacking, i.e. missing X-Frame-Options header.\u003c/li\u003e\n\u003cli\u003ePre-Authentication Account Takeover.\u003c/li\u003e\n\u003cli\u003eCSRF on unauthenticated resources, i.e. login/logout, pages with anonymous access, and non-sensitive information.\u003c/li\u003e\n\u003cli\u003eMobile issues that require root access, i.e. credentials in Android SharedPreferences.\u003c/li\u003e\n\u003cli\u003eNon-sensitive exposed API keys, i.e. Google Maps and Raygun.\u003c/li\u003e\n\u003cli\u003eAbsent or misconfigured HTTP headers, i.e. Content-Security-Policy, Strict-Transport-Security, X-XSS-Protection and Cache-Control.\u003c/li\u003e\n\u003cli\u003eConfiguration that is not directly exploitable, i.e. weak TLS ciphers, password policy, session expiration, and certificate pinning.\u003c/li\u003e\n\u003cli\u003eVulnerabilities exclusive to outdated, unpatched and unsupported browsers, mobile applications and mobile operating systems.\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"883789f2-6911-41e4-904d-0379656c953f","name":"In scope targets","targets":[{"id":"8110dabb-2cb1-4afd-82cf-5ce71c4e13c6","uri":null,"name":"*.jora.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ad380fb2-096c-440a-a95c-d06f8874a5d3","sortOrder":0},"sortOrder":0,"tags":[{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"8110dabb-2cb1-4afd-82cf-5ce71c4e13c6"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8110dabb-2cb1-4afd-82cf-5ce71c4e13c6"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"8110dabb-2cb1-4afd-82cf-5ce71c4e13c6"}],"recentChangeFlags":null},{"id":"d810e48a-343b-4649-b760-0db9413f1c1d","uri":null,"name":"*.jora.xyz","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4981b6ed-df22-4bf5-a500-8c702da13116","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d810e48a-343b-4649-b760-0db9413f1c1d"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d810e48a-343b-4649-b760-0db9413f1c1d"}],"recentChangeFlags":null},{"id":"2ff6ef35-d633-47e1-b7f5-3e9fa5b7ae29","uri":"https://apps.apple.com/au/app/jora-jobs-job-search-work/id917565665","name":"Jora Jobs iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5f339963-c52e-4c5d-8835-a8c4a09cf990","sortOrder":2},"sortOrder":2,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"2ff6ef35-d633-47e1-b7f5-3e9fa5b7ae29"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"2ff6ef35-d633-47e1-b7f5-3e9fa5b7ae29"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"2ff6ef35-d633-47e1-b7f5-3e9fa5b7ae29"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"2ff6ef35-d633-47e1-b7f5-3e9fa5b7ae29"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"2ff6ef35-d633-47e1-b7f5-3e9fa5b7ae29"}],"recentChangeFlags":null},{"id":"7e205bff-6afb-4cc9-8c72-00c4a495cc7f","uri":"https://play.google.com/store/apps/details?id=com.jora.android\u0026hl=en_US\t","name":"Jora Jobs Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"40491811-cbee-4336-a1f5-76dd7eae7e8f","sortOrder":3},"sortOrder":3,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"7e205bff-6afb-4cc9-8c72-00c4a495cc7f"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"7e205bff-6afb-4cc9-8c72-00c4a495cc7f"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"7e205bff-6afb-4cc9-8c72-00c4a495cc7f"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"7e205bff-6afb-4cc9-8c72-00c4a495cc7f"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"56f9a939-ba4a-4461-b6ff-95887dbfef39","p1MaxCents":250000,"p1MinCents":100000,"p2MaxCents":100000,"p2MinCents":50000,"p3MaxCents":50000,"p3MinCents":10000,"p4MaxCents":10000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1000,"max":2500},"2":{"min":500,"max":1000},"3":{"min":100,"max":500},"4":{"min":50,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"b056aa48-aab8-4b8e-ae06-eb7dbfad531b","name":"Out of scope","targets":[{"id":"39fc6850-b0f0-4c98-817b-5313997acee5","uri":null,"name":"*.joralocal.com.au\t","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2a83226d-fbdc-4bde-a11e-fb7d266dbcdd","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"39fc6850-b0f0-4c98-817b-5313997acee5"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"2ec278bf-c5e8-4337-9f2d-df06667bd921","code":"jora","state":"in_progress","endsAt":null,"bountyId":"f17bcac8-6e39-4c7c-a057-85107aaf3702","startsAt":"2019-11-12T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Media","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/6eda/e559/439693f5/dce431212db88afa8537fb6e6ebebf12_image__18_.png","logoBackgroundColor":"#171a17","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2019-11-12T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/jora","changelogs":"/engagements/jora/changelog","submissions":null,"announcements":"/engagements/jora/announcements","hallOfFame":"/engagements/jora/hall_of_fames","crowdstream":"/engagements/jora/crowdstream"},"announcementsCount":4,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/jora/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":"updated","userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=jora\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/jora/engagement_subscribers","engagementChangelogsUrl":"/engagements/jora/changelog","publishedAt":"2026-09-29T05:50:01.933Z","engagementChangelogUrl":"/engagements/jora/changelog/b592ed3f-dd99-4a12-97c8-247fe274c671","createUserFeedbacksUrl":"/engagements/jora/feedbacks","engagementCrowdstreamUrl":"/engagements/jora/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}