{"id":"b9a9ae9f-653c-45bd-8624-34935291c360","engagementId":"2e491dfa-02f7-4349-85ec-6de1a72838fd","data":{"brief":{"id":"65ec5849-1866-4e88-a0df-daf934583c1e","name":"Klaviyo Managed Bug Bounty","tagline":"Klaviyo looks forward to working with the Security community to find security vulnerabilities in order to keep our business and customers safe.","description":"\u003cp\u003eYour participation in our Bug Bounty Program (“Program”) is voluntary. By submitting a report or otherwise disclosing a vulnerability to us (making a “Submission”), you are indicating that you have read and agree to follow the rules for this Program as stated below.  Thank you for helping keep Klaviyo and our users safe.  Good luck and happy hunting! \u003c/p\u003e\n\n\u003ch2\u003eConfidentiality \u0026amp; Coordinated Disclosure\u003c/h2\u003e\n\n\u003cp\u003eAny information you receive or collect about us, our affiliates, or any of our users, employees, or agents in connection with the Bug Bounty Program (\"Confidential Information\") must be used only in connection with the Program.\u003c/p\u003e\n\n\u003cp\u003eThis is a \u003cstrong\u003epublic program operating under coordinated disclosure\u003c/strong\u003e. You may \u003cstrong\u003erequest public disclosure of a resolved Submission\u003c/strong\u003e by submitting a disclosure request through the Bugcrowd platform. Public disclosure is permitted \u003cstrong\u003eonly after\u003c/strong\u003e the issue has been remediated \u003cstrong\u003eand\u003c/strong\u003e you have received Klaviyo's prior written consent. Until then, you may not use, disclose, or distribute any Confidential Information — including details of your Submission. Please follow \u003ca href=\"https://docs.bugcrowd.com/researchers/disclosure/disclosure/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd's disclosure guidelines\u003c/a\u003e. Not all requests for public disclosure can be approved.\u003c/p\u003e\n\n\u003ch2\u003eRights and Licenses\u003c/h2\u003e\n\n\u003cp\u003eWe may modify the Program Terms or cancel the Bug Bounty Program at any time. By making a Submission, you represent and warrant that the Submission is original to you and you have the right to submit it, and you grant us the right to use your Submission for any purpose. Failure to act in good faith will result in immediate disqualification and ineligibility for any benefit of the Program.\u003c/p\u003e","industryTagId":"1bf3970a-395b-4456-b261-d04dab482af2","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Klaviyo not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eEligibility\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eBe 18+ years of age\u003c/li\u003e\n\u003cli\u003eNot be in violation of any national, state, or local law or regulation with respect to any activities directly or indirectly related to the Bug Bounty Program\u003c/li\u003e\n\u003cli\u003eNot be a resident of, or make submissions from a US- or UN-sanctioned country\u003c/li\u003e\n\u003cli\u003eNot be using duplicate Bugcrowd accounts\u003c/li\u003e\n\u003cli\u003eNot be employed by Klaviyo or any of our affiliates or a family member of a person employed by Klaviyo and any of our affiliates. In addition, former Klaviyo employees are not allowed to participate.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eProgram Rules\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eProvide detailed reports with reproducible steps; otherwise the report is not eligible for a reward.\n\n\u003cul\u003e\n\u003cli\u003eTrue impact needs to be demonstrated, simply popping up an alert box for XSS does not clearly identify impact but showing that cookies are vulnerable and can be exfiltrated through XSS would, for example.\u003c/li\u003e\n\u003cli\u003eActionable remediation steps (beyond generic advice)\u003c/li\u003e\n\u003cli\u003eReferences to related CVEs/resources\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eUse your Bugcrowd email address when signing up to the Klaviyo platform.\u003c/li\u003e\n\u003cli\u003eSubmit one vulnerability per report unless chaining is required.\u003c/li\u003e\n\u003cli\u003eDuplicates: only the first fully reproducible report is awarded.\u003c/li\u003e\n\u003cli\u003eMultiple vulnerabilities from one underlying issue = one bounty.\u003c/li\u003e\n\u003cli\u003eSocial engineering (phishing, vishing, smishing) is prohibited; reliant findings rewarded only at our discretion.\u003c/li\u003e\n\u003cli\u003eMake a good-faith effort to avoid privacy violations, data destruction, and service degradation. Only interact with accounts you own or have permission to access.\u003c/li\u003e\n\u003cli\u003eBe respectful of our infrastructure/application. Automated form spam will not be rewarded and may result in a ban.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAttacking customer accounts is strictly prohibited\u003c/strong\u003e.\u003c/li\u003e\n\u003cli\u003eEnumerating the /api/v1/people path is \u003cstrong\u003enot\u003c/strong\u003e covered by our safe harbor, single tests on the base path with no page argument or \"page=1\" \u003cstrong\u003eare\u003c/strong\u003e covered by safe harbor.\u003c/li\u003e\n\u003cli\u003eTargeting the public IP space of 20.* belonging to Microsoft is out of scope; we utilize a private IP space that overlaps their public IP space but is only reachable on VPN / leveraging an attack that can hit internal IP space\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eResponsible Disclosure (Reporting Standards)\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eWalk through the attack scenario in detail with screenshots\u003c/li\u003e\n\u003cli\u003eInclude a security-impact assessment; avoid generic PoCs (javascript:alert(1)) — demonstrate real exfiltration/unauthorized action\u003c/li\u003e\n\u003cli\u003eInclude written reproduction steps (video-only may be ineligible)\u003c/li\u003e\n\u003cli\u003eKeep all information on Bugcrowd (no pastebin/video-sharing sites)\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eIf you encounter PII/regulated data:\u003c/strong\u003e stop (further actions unauthorized)\n\n\u003cul\u003e\n\u003cli\u003eReport immediately\u003c/li\u003e\n\u003cli\u003eDo not save/copy/store/transfer/disclose/retain\u003c/li\u003e\n\u003cli\u003eFor SQLi limit rows returned\u003c/li\u003e\n\u003cli\u003eDelete all local/stored/cached copies ASAP (we may request a certificate of destruction)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003e\u003cstrong\u003eAccess / Credentials\u003c/strong\u003e\u003c/h2\u003e\n\n\u003cp\u003eCreate a free account with \"Bugcrowd\" in the Company Name (e.g. Klaviyo-Bugcrowd). If that breaks a test, place \"Bugcrowd\" elsewhere (email +Bugcrowd, or last name). Roles per the User management \u0026amp; privileges reference.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003ePremium / paid features — invitation only\u003c/strong\u003e. Some features require a premium or paid subscription. \u003cstrong\u003eAccess to premium and paid features is provided on an invitation-only basis\u003c/strong\u003e. Klaviyo provides premium access to selected researchers at its sole discretion; unsolicited requests for premium access are not accepted.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSeverity, Rewards, \u0026amp; Duplicate Handling\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eSeverity\u003c/strong\u003e is assessed using \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd's Vulnerability Rating Taxonomy (VRT)\u003c/a\u003e, mapped to \u003cstrong\u003eP1–P5\u003c/strong\u003e. Final severity is determined by Klaviyo based on demonstrated real-world impact and is at Klaviyo's sole discretion. Where the VRT baseline and demonstrated impact differ, \u003cstrong\u003eimpact governs\u003c/strong\u003e.\u003c/p\u003e\n\n\u003ch3\u003eReward Structure:\u003c/h3\u003e\n\n\u003cp\u003eBounty criticalities and payments are at Klaviyo's discretion. There could be submissions for which we accept the risk and will not fix.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eP1: $2,100 - $3,500\u003c/strong\u003e (e.g. arbitrary code/command execution on a Klaviyo production server or arbitrary SQL queries on Klaviyo databases)\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eP2: $1,000 - $1,750\u003c/strong\u003e (e.g. sensitive user/Klaviyo data in a publicly exposed resource (S3 bucket), privilege escalation within the application)\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eP3: $450 - $600\u003c/strong\u003e (e.g. XSS; bypassing CSRF validation for low risk actions)\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eP4: $150 - $200\u003c/strong\u003e (determined by the Klaviyo team based on potential impact)\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eP5 / Informational: No reward\u003c/strong\u003e (accepted for tracking only)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eDuplicate Rules:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eOnly the \u003cstrong\u003efirst fully reproducible report\u003c/strong\u003e of a unique underlying issue is eligible for a reward; later reports of the same issue are \u003cstrong\u003emarked Duplicate\u003c/strong\u003e and not rewarded.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eMultiple vulnerabilities stemming from one underlying root cause are awarded a single bounty\u003c/strong\u003e.\u003c/li\u003e\n\u003cli\u003eSubmit \u003cstrong\u003eone vulnerability per report\u003c/strong\u003e, unless chaining is required to demonstrate impact.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eResponse Targets (SLA)\u003c/h2\u003e\n\n\u003cp\u003eKlaviyo commits to the following \u003cstrong\u003eengagement targets\u003c/strong\u003e for valid submissions (business days): \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eTime to first response: 3\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTime to triage/validation: 5\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTime to reward decision: within 5 of triage\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003eValidated findings are routed to the owning engineering team and remediated on a \u003cstrong\u003erisk-based timeline prioritized by severity\u003c/strong\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cp\u003eWe encourage research on Klaviyo's newest features, listed below. Stay within the in-scope targets and rules above (own/authorized accounts only; attacking customer accounts is strictly prohibited). Full list: \u003ca href=\"https://www.klaviyo.com/whats-new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.klaviyo.com/whats-new\u003c/a\u003e.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAI Agents — Composer, Customer Agent, Social Insights Agent. Prompt injection via attacker-controlled context, agent tool abuse, and cross-tenant data exposure in generated output.\u003c/li\u003e\n\u003cli\u003eCustomer Agent — Profile Enrichment \u0026amp; Multilingual. Injection into profile fields written from conversation input, and authorization on profile writes.\u003c/li\u003e\n\u003cli\u003eSocial Marketing — Instagram Integration. OAuth/connection flow, SSRF via media URLs, and stored XSS from ingested comments/UGC.\u003c/li\u003e\n\u003cli\u003eCustom Object Expansion — Snowflake / BigQuery. Outbound connection config (SSRF, credential handling) and injection into segmentation queries.\u003c/li\u003e\n\u003cli\u003eWhatsApp Enhancements \u0026amp; Website Personalization. Injection through collected/quiz input and XSS in storefront banners/recommendations.\u003c/li\u003e\n\u003cli\u003eEmail Open Tracking Consent. Authorization/IDOR on tracking preference changes.\u003c/li\u003e\n\u003cli\u003eComing soon (not yet generally testable): Multi-Branch Flows.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eBroken Access Control Submissions\u003c/h2\u003e\n\n\u003cp\u003eBAC findings must show clear malicious impact or attacker benefit to rate P4+. BACs based only on doc-vs-reality discrepancy without malicious impact are Informational. Final severity at Klaviyo's discretion.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExcluded Vulnerability Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eCustomer private keys exposed by customers/employees (report to the customer directly; do not disclose the Klaviyo program; share with Klaviyo only if customer unresponsive/unidentifiable or impact exceeds a single account)\u003c/li\u003e\n\u003cli\u003eStored XSS impacting only the originating account is out of scope; stored XSS impacting email recipients or other accounts is in scope\u003c/li\u003e\n\u003cli\u003eClickjacking on non-sensitive pages\u003c/li\u003e\n\u003cli\u003ePassword/email/account policy issues (case-by-case)\u003c/li\u003e\n\u003cli\u003eCSRF on unauthenticated/non-sensitive forms\u003c/li\u003e\n\u003cli\u003ePhysical/wireless attacks\u003c/li\u003e\n\u003cli\u003eSocial engineering \u003c/li\u003e\n\u003cli\u003eSoftware version disclosure\u003c/li\u003e\n\u003cli\u003eKnown vulnerable libraries without a working PoC\u003c/li\u003e\n\u003cli\u003eDoS/DDoS\u003c/li\u003e\n\u003cli\u003eContent spoofing/text injection without an attack vector\u003c/li\u003e\n\u003cli\u003eRate-limiting/brute-force on non-auth endpoints\u003c/li\u003e\n\u003cli\u003eMissing CSP best practices\u003c/li\u003e\n\u003cli\u003eMissing HttpOnly/Secure on non-sensitive cookies\u003c/li\u003e\n\u003cli\u003eMissing email best practices (SPF/DKIM/DMARC)\u003c/li\u003e\n\u003cli\u003eCSRF on logout without a non-trivial PoC\u003c/li\u003e\n\u003cli\u003eHost header injection unless it steals user data\u003c/li\u003e\n\u003cli\u003eOutdated-browser-only issues\u003c/li\u003e\n\u003cli\u003eBanner/version/error-message disclosure\u003c/li\u003e\n\u003cli\u003ePublic zero-days patched \u0026lt;1 month (case-by-case)\u003c/li\u003e\n\u003cli\u003eAutomated tool/scan reports\u003c/li\u003e\n\u003cli\u003eTabnabbing\u003c/li\u003e\n\u003cli\u003eOpen redirect without added impact\u003c/li\u003e\n\u003cli\u003eIssues requiring unlikely user interaction\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eTemporary Excluded Vulnerabilities\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003epantheon.io subdomain takeovers\u003c/li\u003e\n\u003cli\u003eDevice Verification Token Bypass\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), with no legal action for accidental good-faith violations\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA)\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with researcher (waived on a limited basis)\u003c/li\u003e\n\u003cli\u003eLawful, helpful, and conducted in good faith\u003c/li\u003e\n\u003cli\u003eYou must comply with all applicable laws\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf uncertain whether your research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"2e20b88d-6b19-4c35-937d-9aed8aed878e","name":"In Scope","targets":[{"id":"a6b44b02-05a5-4d9e-a97b-eb04ed79301f","uri":"https://*.myklpages.com/*","name":"Klaviyo Hosted Pages - myklpages.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e0626fea-352a-459d-9994-8437d675de31","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a6b44b02-05a5-4d9e-a97b-eb04ed79301f"}],"recentChangeFlags":null},{"id":"2dd6e349-a751-4ae1-88d4-318faba803df","uri":"https://a.klaviyo.com/api/*","name":"Klaviyo APIs - a.klaviyo.com/api","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7d1f1900-ab08-4535-ae81-5567ba45bcba","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"2dd6e349-a751-4ae1-88d4-318faba803df"},{"id":"6a9fe373-cb50-48a4-8f00-f390acde8447","name":"JSON","targetId":"2dd6e349-a751-4ae1-88d4-318faba803df"}],"recentChangeFlags":null},{"id":"1a8a9099-3882-4a87-bd5d-8b373d12a8ac","uri":"https://klaviyo.com/*","name":"Klaviyo WebApp - klaviyo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"08ef644c-f93a-430a-8982-267c443e5f07","sortOrder":2},"sortOrder":2,"tags":[{"id":"84ff9b26-d234-4bba-8b77-f0f02d67d359","name":"Django","targetId":"1a8a9099-3882-4a87-bd5d-8b373d12a8ac"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1a8a9099-3882-4a87-bd5d-8b373d12a8ac"}],"recentChangeFlags":null},{"id":"80541b12-b549-424a-99f3-ee1db9d46284","uri":"https://*.services.klaviyo.com","name":"Klaviyo Services - *.services.klaviyo.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b2ac1715-9963-4e45-abb2-9e4f3101e062","sortOrder":3},"sortOrder":3,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"80541b12-b549-424a-99f3-ee1db9d46284"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"80541b12-b549-424a-99f3-ee1db9d46284"}],"recentChangeFlags":null},{"id":"04c631b8-1d7e-4e43-95b3-3d1fa1694b18","uri":"https://*.klaviyomsv.com/*","name":"Klaviyo MSV - klaviyomsv.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0c93cecc-89eb-4572-9e39-2902563070ca","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"04c631b8-1d7e-4e43-95b3-3d1fa1694b18"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"04c631b8-1d7e-4e43-95b3-3d1fa1694b18"}],"recentChangeFlags":null},{"id":"ad8a83da-4aaa-490e-96c1-c38c08684835","uri":"https://*.klaviyo-dev.com/*","name":"Klaviyo Dev - klaviyo-dev.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"de6bc165-63b4-4d3e-8392-2b4b5969a0b6","sortOrder":5},"sortOrder":5,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"ad8a83da-4aaa-490e-96c1-c38c08684835"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ad8a83da-4aaa-490e-96c1-c38c08684835"}],"recentChangeFlags":null},{"id":"2032d041-33c4-4e31-8716-7503a75c2a0d","uri":"http://mcp.klaviyo.com/","name":"Klaviyo MCP - mcp.klaviyo.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"88d7b1ba-42d0-409b-8f3a-f9cbfe2866a2","sortOrder":6},"sortOrder":6,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"2032d041-33c4-4e31-8716-7503a75c2a0d"}],"recentChangeFlags":null},{"id":"ad53f62b-f813-443a-8751-2747d20801c9","uri":"https://*.clovesoftware.com","name":"Klaviyo App - *.clovesoftware.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"655a49d7-f58b-48fe-95c2-02bc03ec3d1a","sortOrder":7},"sortOrder":7,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"ad53f62b-f813-443a-8751-2747d20801c9"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ad53f62b-f813-443a-8751-2747d20801c9"}],"recentChangeFlags":null},{"id":"574cc3ab-7a81-45b5-a461-88630416b885","uri":"https://*.clovesoftware-dev.com","name":"Klaviyo Dev - *.clovesoftware-dev.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"19452f67-1e42-4240-9839-d87dd82dd323","sortOrder":8},"sortOrder":8,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"574cc3ab-7a81-45b5-a461-88630416b885"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"574cc3ab-7a81-45b5-a461-88630416b885"}],"recentChangeFlags":null},{"id":"17a48c87-f5df-48e2-9d30-bda574405ba3","uri":"","name":"Klaviyo AWS/S3 Assets","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7aabb7c8-242f-466e-af94-b75b8d50d0a0","sortOrder":9},"sortOrder":9,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"17a48c87-f5df-48e2-9d30-bda574405ba3"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"17a48c87-f5df-48e2-9d30-bda574405ba3"}],"recentChangeFlags":null},{"id":"1e9c8248-59ff-40d8-b788-f23632815c0f","uri":"","name":"Klaviyo Infrastructure - 12.109.179.242/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bff80bc8-3442-483c-b526-a0000c73d275","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null},{"id":"3974498d-7708-4f8d-8775-fd0f4a59d63a","uri":"","name":"Klaviyo Infrastructure - 12.109.179.243/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8e7732b7-43f2-4122-9c7b-bfc87dff1961","sortOrder":11},"sortOrder":11,"tags":null,"recentChangeFlags":null},{"id":"bb02cda3-3867-4821-b148-79992755e811","uri":"","name":"Klaviyo Infrastructure - 12.109.179.244/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4b0691d5-cbec-4685-b50c-00e8ce963837","sortOrder":12},"sortOrder":12,"tags":null,"recentChangeFlags":null},{"id":"de3939f2-0d0f-4a99-8f74-75f3f667b73c","uri":"","name":"Klaviyo Infrastructure - 12.162.226.194/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"de319763-9ae9-4be9-9499-f680ba8e910f","sortOrder":13},"sortOrder":13,"tags":null,"recentChangeFlags":null},{"id":"fd80916b-8a0d-40c8-93f4-62e39d1dddd6","uri":"","name":"Klaviyo Infrastructure - 12.162.226.195/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"286269e4-15fb-492c-8adb-9eca9549b304","sortOrder":14},"sortOrder":14,"tags":null,"recentChangeFlags":null},{"id":"c279107e-509e-4369-b063-ee3c12cf58af","uri":"","name":"Klaviyo Infrastructure - 12.162.226.196/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"de6fbbbf-9965-4dec-99cc-3aa8e4f697f5","sortOrder":15},"sortOrder":15,"tags":null,"recentChangeFlags":null},{"id":"f0478c49-fafa-4f8a-878b-91bb0c2cf0ef","uri":"","name":"Klaviyo Infrastructure - 12.162.226.197/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"278ca452-c468-4ef3-b66c-2f9ea792b764","sortOrder":16},"sortOrder":16,"tags":null,"recentChangeFlags":null},{"id":"d102d7a2-041e-4c71-81a2-3adf10a4ddf4","uri":"","name":"Klaviyo Infrastructure - 12.162.226.198/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6bb9b021-12d6-40eb-9660-a5735832ba77","sortOrder":17},"sortOrder":17,"tags":null,"recentChangeFlags":null},{"id":"e943ba07-35ee-41ca-8bfc-2983db1ca65b","uri":"","name":"Klaviyo Infrastructure - 13.236.111.63/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"037b1470-5c4d-4423-bc1f-711ba78ad63a","sortOrder":18},"sortOrder":18,"tags":null,"recentChangeFlags":null},{"id":"664bc4ba-c282-4ae7-902e-2e6a6998c8bc","uri":"","name":"Klaviyo Infrastructure - 14.200.250.155/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"36098dc2-49da-4715-99e3-2aba28fea944","sortOrder":19},"sortOrder":19,"tags":null,"recentChangeFlags":null},{"id":"dc0f7982-0d23-4e26-9845-62c8d306e4c6","uri":"","name":"Klaviyo Infrastructure - 14.200.250.156/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"adf7a5a1-53f5-4bbb-b633-e8109568a5a6","sortOrder":20},"sortOrder":20,"tags":null,"recentChangeFlags":null},{"id":"bb5c215a-bcac-4860-a37d-40ff478e835b","uri":"","name":"Klaviyo Infrastructure - 144.121.5.144/29","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"594a00e3-7b5c-4a72-9abc-7f45a27255dc","sortOrder":21},"sortOrder":21,"tags":null,"recentChangeFlags":null},{"id":"5486b586-f5fb-4851-85ef-eaa6e320decc","uri":"","name":"Klaviyo Infrastructure - 144.121.57.208/29","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b5616a42-48ca-45ad-a447-9c9b78c3b4c4","sortOrder":22},"sortOrder":22,"tags":null,"recentChangeFlags":null},{"id":"787e59b3-51e8-48a2-9694-40c8828f0140","uri":"","name":"Klaviyo Infrastructure - 18.133.56.249/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"75b82606-9399-4738-8092-3f0502ffaf2d","sortOrder":23},"sortOrder":23,"tags":null,"recentChangeFlags":null},{"id":"beaac2a1-f91d-45a3-934d-78ac68a927cb","uri":"","name":"Klaviyo Infrastructure - 18.144.159.16/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0834522c-b745-475a-aa0c-aac587608c66","sortOrder":24},"sortOrder":24,"tags":null,"recentChangeFlags":null},{"id":"646b184d-08c9-469c-8c2f-5481971cd2a5","uri":"","name":"Klaviyo Infrastructure - 18.168.137.251/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0042bcc9-cb94-49d7-87be-90cdaef6dff7","sortOrder":25},"sortOrder":25,"tags":null,"recentChangeFlags":null},{"id":"cacd9e16-c4d5-45f5-bf00-c657dfb17ba0","uri":"","name":"Klaviyo Infrastructure - 18.168.212.94/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e13f0e18-3bad-4903-8cb3-b6bd149bc33b","sortOrder":26},"sortOrder":26,"tags":null,"recentChangeFlags":null},{"id":"978d184e-c994-4bc3-a33d-a91ea2268c11","uri":"","name":"Klaviyo Infrastructure - 18.168.232.92/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6b85b4c4-10bf-4cd8-80b5-ef27d1139fd2","sortOrder":27},"sortOrder":27,"tags":null,"recentChangeFlags":null},{"id":"d20b53e6-a4cc-4b4a-8c7c-853507a9fcb9","uri":"","name":"Klaviyo Infrastructure - 23.20.21.255/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7e9fac70-7be0-4d93-9adf-10363251108f","sortOrder":28},"sortOrder":28,"tags":null,"recentChangeFlags":null},{"id":"c299da1c-bd7f-4080-afd5-ac5b11797568","uri":"","name":"Klaviyo Infrastructure - 3.105.93.78/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c32f63fb-7c00-4e90-9ba9-d7ed4ebfa274","sortOrder":29},"sortOrder":29,"tags":null,"recentChangeFlags":null},{"id":"0cae9d22-5913-4a7b-8bfc-e35d268d44bb","uri":"","name":"Klaviyo Infrastructure - 3.208.141.108/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"85f01f8f-70b5-461c-8dd3-cfb0c704dcf4","sortOrder":30},"sortOrder":30,"tags":null,"recentChangeFlags":null},{"id":"ec876621-9473-41d7-96f9-14730513f143","uri":"","name":"Klaviyo Infrastructure - 3.222.226.200/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b344369c-1368-41d5-bebd-5c05b77aeb3b","sortOrder":31},"sortOrder":31,"tags":null,"recentChangeFlags":null},{"id":"a659f5cc-e834-4f07-8cb3-5ebea71544df","uri":"","name":"Klaviyo Infrastructure - 38.140.97.154/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c64b01d4-500b-43f7-b9e4-7f90c4f84161","sortOrder":32},"sortOrder":32,"tags":null,"recentChangeFlags":null},{"id":"9af2c7bd-abe0-443a-aca5-b493ff4c036b","uri":"","name":"Klaviyo Infrastructure - 38.140.97.155/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"96a61d68-b0d4-4d10-b671-6905a64e30e1","sortOrder":33},"sortOrder":33,"tags":null,"recentChangeFlags":null},{"id":"a0aa7cea-a0d5-462d-953f-dd1c185a4607","uri":"","name":"Klaviyo Infrastructure - 38.140.97.156/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"310ec784-db89-458c-bb75-f9bc25e827e3","sortOrder":34},"sortOrder":34,"tags":null,"recentChangeFlags":null},{"id":"6903f508-311e-461e-9792-e76522ab5409","uri":"","name":"Klaviyo Infrastructure - 44.197.10.144/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d92a66c1-42c2-415f-978f-75da7f685ac2","sortOrder":35},"sortOrder":35,"tags":null,"recentChangeFlags":null},{"id":"f85ba4b1-9697-49ff-9ee3-4738e9c5a287","uri":"","name":"Klaviyo Infrastructure - 46.31.171.122/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"abe08de2-1da9-48d8-900d-b2303f711707","sortOrder":36},"sortOrder":36,"tags":null,"recentChangeFlags":null},{"id":"4f59cf12-b7a7-4f47-8e08-3e84ad6452c1","uri":"","name":"Klaviyo Infrastructure - 46.31.171.123/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"eaec434b-29b5-4c7b-9cfd-11686ebad7ae","sortOrder":37},"sortOrder":37,"tags":null,"recentChangeFlags":null},{"id":"c1c46a40-5cf7-468d-87d4-027c9ad5f038","uri":"","name":"Klaviyo Infrascucture - 50.150.76.0/30","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9af17e67-f8c9-4f6f-9f5f-7fe39bf6d55c","sortOrder":38},"sortOrder":38,"tags":null,"recentChangeFlags":null},{"id":"9c92ea0f-17b7-43bb-8542-3bf217ed73dd","uri":"","name":"Klaviyo Infrastructure - 50.18.34.165/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fbed6dc6-197c-4b50-a1b0-f4d496444db5","sortOrder":39},"sortOrder":39,"tags":null,"recentChangeFlags":null},{"id":"7487c70e-946c-458b-9cae-e80eb5a69326","uri":"","name":"Klaviyo Infrastructure - 50.228.235.80/29","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b0b99781-d027-4b00-b19c-957d6d340c1e","sortOrder":40},"sortOrder":40,"tags":null,"recentChangeFlags":null},{"id":"44fb84aa-f51e-427e-b934-ce725cd1bc2e","uri":"","name":"Klaviyo Infrastructure - 52.8.118.227/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"da939dc8-ac1c-49aa-8c48-7a65770d47e1","sortOrder":41},"sortOrder":41,"tags":null,"recentChangeFlags":null},{"id":"74bbe228-a2e1-4a64-bbe8-f31cf568d6c9","uri":"","name":"Klaviyo Infrastructure - 54.160.106.200/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bad7384e-76e8-4aa1-bbc7-23a9f5f06267","sortOrder":42},"sortOrder":42,"tags":null,"recentChangeFlags":null},{"id":"25b5008d-f0ef-4698-b479-2c26e905f00e","uri":"","name":"Klaviyo Infrastructure - 64.125.104.194/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a9355556-8901-4b9e-98df-70121cf4b199","sortOrder":43},"sortOrder":43,"tags":null,"recentChangeFlags":null},{"id":"5aa3d93c-4d36-4360-9ab8-7592a97a356e","uri":"","name":"Klaviyo Infrastructure - 64.125.104.195/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4d07f1ce-1c9c-408a-a428-ea6d888302c1","sortOrder":44},"sortOrder":44,"tags":null,"recentChangeFlags":null},{"id":"85c44890-89c2-4180-a6b5-4a0c99ffd51c","uri":"","name":"Klaviyo Infrastructure - 64.125.104.196/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d781cf13-8003-4925-ba62-bbf5a4f3fabf","sortOrder":45},"sortOrder":45,"tags":null,"recentChangeFlags":null},{"id":"6a251bdf-4216-4ca3-8813-dadaddf8ddd0","uri":"","name":"Klaviyo Infrastructure - 64.125.104.197/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6158d451-7721-4157-926f-3b73df3984af","sortOrder":46},"sortOrder":46,"tags":null,"recentChangeFlags":null},{"id":"df6e810c-5094-48ee-86f3-116c501f99c0","uri":"","name":"Klaviyo Infrastructure - 64.125.104.198/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3dc1d546-f3c5-414b-b6b3-cda9fe12e890","sortOrder":47},"sortOrder":47,"tags":null,"recentChangeFlags":null},{"id":"813ae79c-13ca-4a3d-a29c-ef0af0edcb07","uri":"","name":"Klaviyo Infrastructure - 64.71.19.71/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b0e0688d-4b44-4997-8831-96edb3c3270c","sortOrder":48},"sortOrder":48,"tags":null,"recentChangeFlags":null},{"id":"bdc5b88e-943d-4199-9832-7a20687a59fb","uri":"","name":"Klaviyo Infrastructure - 82.144.244.58/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"691a3654-85b9-4942-8628-8b73f02c1755","sortOrder":49},"sortOrder":49,"tags":null,"recentChangeFlags":null},{"id":"90fbfcf2-fb1c-49b3-a44d-77007f8d594a","uri":"","name":"Klaviyo Infrastructure - 82.144.244.59/32","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a5041534-c39f-43a1-9aa0-c0628d3c6421","sortOrder":50},"sortOrder":50,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"d2eeb990-1da1-414f-86e5-bb3ee24dcda2","p1MaxCents":350000,"p1MinCents":210000,"p2MaxCents":175000,"p2MinCents":100000,"p3MaxCents":60000,"p3MinCents":45000,"p4MaxCents":20000,"p4MinCents":15000,"p5MaxCents":5000,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eTarget Information\u003c/h2\u003e\n\n\u003cp\u003eKlaviyo infrastructure includes our office IP addresses and VPN endpoints \u003c/p\u003e\n\n\u003ch2\u003eDocumentation\u003c/h2\u003e\n\n\u003cp\u003e\u003ca href=\"https://developers.klaviyo.com/en/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAPI Documentation\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://help.klaviyo.com/hc/en-us\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eWeb Application Documentation\u003c/a\u003e\u003c/p\u003e","rewardRangeData":{"1":{"min":2100,"max":3500},"2":{"min":1000,"max":1750},"3":{"min":450,"max":600},"4":{"min":150,"max":200},"5":{"min":0,"max":50}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"2e491dfa-02f7-4349-85ec-6de1a72838fd","code":"klaviyo-og","state":"in_progress","endsAt":null,"bountyId":"39e9ef49-4805-4c73-a799-d21fe3bf0305","startsAt":"2022-11-29T00:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"eCommerce","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/0de0/af18/2047bf3f/0d5b29262e5c3a188505deb379573f48_1648068341498.jpeg","logoBackgroundColor":"#fffaf3","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-12-05T14:15:22.275Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/klaviyo-og","changelogs":"/engagements/klaviyo-og/changelog","submissions":null,"announcements":"/engagements/klaviyo-og/announcements","hallOfFame":"/engagements/klaviyo-og/hall_of_fames","crowdstream":"/engagements/klaviyo-og/crowdstream"},"announcementsCount":9,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/klaviyo-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=klaviyo-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/klaviyo-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/klaviyo-og/changelog","publishedAt":"2026-09-09T19:16:13.875Z","engagementChangelogUrl":"/engagements/klaviyo-og/changelog/b9a9ae9f-653c-45bd-8624-34935291c360","createUserFeedbacksUrl":"/engagements/klaviyo-og/feedbacks","engagementCrowdstreamUrl":"/engagements/klaviyo-og/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}