{"id":"99ddabca-887f-4f9a-8230-3810e9cf08ae","engagementId":"e980278c-6dd0-4522-93dc-052f612f293e","data":{"brief":{"id":"82a9227a-094c-4cf9-a8bc-caf1fef1de93","name":"Kmart Group (Kmart, Target) Vulnerability Disclosure Program","tagline":"Kmart Group which includes Kmart Australia and Target Australia are two of Australia and New Zealand’s most loved retailers. Kmart Group is committed to providing enjoyable and seamless shopping experiences for customers both in stores and online.","description":"\u003cp\u003eNo technology is perfect and Kmart Group believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our program.\u003c/p\u003e\n\n\u003cp\u003eGood luck, and happy hunting!\u003c/p\u003e\n\n\u003cp\u003ePlease note this VDP relates to Kmart and Target Australian online stores and apps. Stores with the same names in the US or any other country, which are not part of Kmart Group, are out of scope and not to be tested on. \u003c/p\u003e\n\n\u003cp\u003eFor account sign ups please use your Bugcrowd email address.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Kmart Australia Limited not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Kmart Australia Limited, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDoS and DDoS attacks.\u003c/li\u003e\n\u003cli\u003eAutomated tools for fuzzing.\u003c/li\u003e\n\u003cli\u003eDelete functionality – please do not delete data\u003c/li\u003e\n\u003cli\u003ekmart.com.au  authentication\n\n\u003cul\u003e\n\u003cli\u003eAuth is hosted by Auth0 and not by Kmart and is excluded. Their policy is here: \u003ca href=\"https://auth0.com/docs/troubleshoot/customer-support/operational-policies/penetration-testing-policy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://auth0.com/docs/troubleshoot/customer-support/operational-policies/penetration-testing-policy\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"90206792-2ead-45be-947f-5a7463c2b2ad","name":"Kmart Online Australia","targets":[{"id":"2408bcc9-b6d7-49d6-a341-440827b18b3e","uri":"https://kmart.com.au/","name":"https://kmart.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"aaa6787a-2c88-4028-9560-5520a19990ba","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"2408bcc9-b6d7-49d6-a341-440827b18b3e"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"2408bcc9-b6d7-49d6-a341-440827b18b3e"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"2408bcc9-b6d7-49d6-a341-440827b18b3e"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"2408bcc9-b6d7-49d6-a341-440827b18b3e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2408bcc9-b6d7-49d6-a341-440827b18b3e"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eKmart Australia online shopping store. This is the production environment. Please note this is Kmart Australia. All other Kmart stores in other countries are out of scope.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"3cd3d930-64c1-4650-8099-9ffb4b6cb3bb","name":"Kmart Mobile Application","targets":[{"id":"bcc78c55-465d-484a-91ca-0eebfce26010","uri":"https://play.google.com/store/apps/details?id=au.com.kmart","name":"Kmart Mobile Application - Android","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"56544470-e9e2-4b2a-b952-de2177c5167d","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"bcc78c55-465d-484a-91ca-0eebfce26010"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"bcc78c55-465d-484a-91ca-0eebfce26010"}],"recentChangeFlags":null},{"id":"9733abfd-57e5-4fcd-9ec4-2c7c4e64f250","uri":"https://apps.apple.com/au/app/kmart/id1611129681","name":"Kmart Mobile Application - iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"140825f2-6f1a-4a99-b715-c364074939fa","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"9733abfd-57e5-4fcd-9ec4-2c7c4e64f250"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"9733abfd-57e5-4fcd-9ec4-2c7c4e64f250"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eKmart mobile applications. These apps are pointing to the production environment. Please note this is Kmart Australia. All other Kmart stores in other countries are out of scope.\u003c/p\u003e\n\n\u003cp\u003eIOS and Android Apps can be obtained from the app stores. \u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"d2805349-9ffa-4cec-a3b3-ca7f96126381","name":"Target Online Australia ","targets":[{"id":"0a78b698-cca9-4930-846a-808ea1390e5b","uri":"https://target.com.au","name":"https://target.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"214c3bb2-67a5-4155-9572-81e25177f4da","sortOrder":0},"sortOrder":0,"tags":[{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"0a78b698-cca9-4930-846a-808ea1390e5b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0a78b698-cca9-4930-846a-808ea1390e5b"},{"id":"d866e8ba-8dcd-4711-a16d-abaccdd975ec","name":"WAF/RASP Bypass","targetId":"0a78b698-cca9-4930-846a-808ea1390e5b"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eTarget online shopping store. This is the production environment. Please note this is Target Australia. All other Target stores in other countries are out of scope.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"85d57eda-82ec-43be-abdc-b73c3c452400","name":"Target Mobile Application","targets":[{"id":"124adba7-3839-4879-ae03-7efcad64caec","uri":"https://apps.apple.com/app/apple-store/id440622971","name":"Target Mobile App - iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cfa52f5c-a5ad-44c5-929e-8eeeb655def3","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"124adba7-3839-4879-ae03-7efcad64caec"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"124adba7-3839-4879-ae03-7efcad64caec"}],"recentChangeFlags":null},{"id":"b2e3fd1d-2329-446d-b696-8ec1e491c181","uri":"https://play.google.com/store/apps/details?id=com.lasoo.android.target","name":"Target Mobile App -  Android","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f2a1d7b3-db32-4d03-b33e-ed1c28d1ad0c","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"b2e3fd1d-2329-446d-b696-8ec1e491c181"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"b2e3fd1d-2329-446d-b696-8ec1e491c181"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eTarget mobile applications. These apps are pointing to the production environment. Please note this is Target Australia. All other Target stores in other countries are out of scope.\u003c/p\u003e\n\n\u003cp\u003eIOS and Android Apps can be obtained from the app store links.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"e980278c-6dd0-4522-93dc-052f612f293e","code":"kmartaustralia-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"b4d67f54-de40-46bc-b553-ff51c7d48835","startsAt":"2023-04-18T00:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/00ad/1684/ccb789ba/afa49abe6ba4bacbe5887f4c08396255_Screenshot_2023-04-26_at_9.43.41_AM.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2026-09-16T05:58:32.632Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/kmartaustralia-vdp-pro","changelogs":"/engagements/kmartaustralia-vdp-pro/changelog","submissions":null,"announcements":"/engagements/kmartaustralia-vdp-pro/announcements","hallOfFame":"/engagements/kmartaustralia-vdp-pro/hall_of_fames","crowdstream":"/engagements/kmartaustralia-vdp-pro/crowdstream"},"announcementsCount":5,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Priority Triage","submitReportUrl":"/engagements/kmartaustralia-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=kmartaustralia-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/kmartaustralia-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/kmartaustralia-vdp-pro/changelog","publishedAt":"2026-09-16T05:58:32.674Z","engagementChangelogUrl":"/engagements/kmartaustralia-vdp-pro/changelog/99ddabca-887f-4f9a-8230-3810e9cf08ae","createUserFeedbacksUrl":"/engagements/kmartaustralia-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/kmartaustralia-vdp-pro/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}