{"id":"f7ab1882-c840-4d13-9bf5-2022c4474030","engagementId":"3c1d9d1d-e88d-4a8e-98c5-c8669145e46f","data":{"brief":{"id":"289fcfed-f743-44ec-85b9-e74272c73db3","name":"The Kroger Co - Vulnerability Disclosure Program ","tagline":"At Kroger, we believe no matter who you are or how you like to shop, everyone deserves affordable, easy-to-enjoy, fresh food.","description":"\u003cp\u003eThe Kroger Family of Companies (Kroger) is committed to maintaining the security of our  systems and data. If you believe that you have identified a security vulnerability in any of our sites or applications, please report it to us responsibly. We appreciate your assistance with our security efforts.\u003c/p\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003ch3\u003eTesting is authorized on the websites and applications in scope. You are not authorized to test any website, application, asset, domain, or IP address outside the scope of this Policy. However, if you become aware of an out-of-scope vulnerability, please report the finding for our review.\u003c/h3\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRules of Engagement\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not publicly or privately disclose any vulnerabilities or other details or descriptions of your findings unless and until Kroger provides express written consent.\u003c/li\u003e\n\u003cli\u003eDestroy all evidence, documentation, and other artifacts related to the findings in your report at the conclusion of this engagement.\u003c/li\u003e\n\u003cli\u003eDo not perform any of the Out of Scope Activities or test for the Out of Scope Vulnerabilities listed below.\u003c/li\u003e\n\u003cli\u003eOnly test websites and applications that are in scope, as listed above.\u003c/li\u003e\n\u003cli\u003eSubmit any potential vulnerabilities in a timely manner.\u003c/li\u003e\n\u003cli\u003eMake every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing.\u003c/li\u003e\n\u003cli\u003eCooperate with us while we review your submission to determine if the finding is valid and has not been previously reported.\u003c/li\u003e\n\u003cli\u003eDo not to attempt to threaten or extort Kroger.\u003c/li\u003e\n\u003cli\u003eDo not attempt to perform brute-force attacks or denial-of-service attacks.\u003c/li\u003e\n\u003cli\u003eDo not attempt to log in to or otherwise test, access, or compromise Kroger employee, contractor, or customer accounts that are not your own.\u003c/li\u003e\n\u003cli\u003eDo not attempt to modify or destroy data, interrupt or degrade Kroger services, pivot with elevated privileges (i.e., no lateral movement), or conduct other post-exploitation activities.\u003c/li\u003e\n\u003cli\u003eDo not attempt to target Kroger employees, contractors, or customers, including by social engineering, phishing, or physical attacks.\u003c/li\u003e\n\u003cli\u003eDo not perform physical attacks against any Kroger facility.\u003c/li\u003e\n\u003cli\u003eIf you encounter personal data that is not your own, stop and report this finding to us, including a description of the data you accessed. Do not save, copy, transfer, or otherwise use this data, and promptly delete any copies of this data.\u003c/li\u003e\n\u003cli\u003eComply with all applicable laws and regulations.\u003c/li\u003e\n\u003cli\u003eConfigure your User-Agent string to krogervulnerabilityresearcher_[yourbugcrowdusername] while testing Kroger websites.\u003c/li\u003e\n\u003cli\u003eAutomated scanners and tools are allowed, provided the above User-Agent is applied and scanners/tools are configured to not send more than 5 requests per second to any one website or application.\u003c/li\u003e\n\u003cli\u003eAvoid exposure of vulnerability information and sensitive data to third parties. Do not use third-party websites or services when testing. Use only assets and domains that you expressly own and control.\u003c/li\u003e\n\u003cli\u003eResidents of or individuals located in regions against which the United States has issued export sanctions or other trade restrictions (e.g., Cuba, Iran, North Korea, Sudan, and Syria) and other sanctioned individuals are prohibited from carrying out any activities, including conducting research and submitting reports under this Policy.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eBy submitting your report to us:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou represent that you abided by this Policy, including all of the above Rules of Engagement, at all times while testing, researching, and preparing the report.\u003c/li\u003e\n\u003cli\u003eYou agree to continue to abide by this Policy, including all of the above Rules of Engagement.\u003c/li\u003e\n\u003cli\u003eYou represent that the report is original to you and that you did not copy the report or any part of it from a third party.\u003c/li\u003e\n\u003cli\u003eYou grant Kroger the unconditional and unrestricted right to use, distribute, and/or disclose your report and any information provided in your report.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eOur Commitment:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eWe will acknowledge receipt of each vulnerability report we receive, review each report to determine if the finding is valid and has not been previously reported and conduct a thorough investigation. \u003c/li\u003e\n\u003cli\u003eWe will address a validated vulnerability appropriately per the assessed risk, in our discretion. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope Activities and Vulnerabilities\u003c/h2\u003e\n\n\u003ch3\u003eOut of Scope Activities:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAccessing, downloading, or modifying data residing in any system or account that does not belong to you. \u003c/li\u003e\n\u003cli\u003eAny actions, including accessing or attempting to access Kroger’s data, beyond what is required for the initial proof of vulnerability.\u003c/li\u003e\n\u003cli\u003eDestruction or corruption of data, information, or infrastructure, including any attempts to do so.\u003c/li\u003e\n\u003cli\u003eExecuting or attempting to execute any social engineering attacks, including phishing.\u003c/li\u003e\n\u003cli\u003ePosting, transmitting, uploading, linking to, sending, or storing any malicious software.\u003c/li\u003e\n\u003cli\u003eTesting in a manner that would result in the sending unsolicited or unauthorized junk mail, spam, pyramid schemes, or other forms of unsolicited messages.\u003c/li\u003e\n\u003cli\u003eTesting in a manner that would damage or degrade the operation any of Kroger’s systems.\u003c/li\u003e\n\u003cli\u003eTesting third-party applications, websites, or services that integrate with or link to Kroger systems.\u003c/li\u003e\n\u003cli\u003eTesting that may violate any applicable law, regulation, or agreement.\u003c/li\u003e\n\u003cli\u003eTesting that may impact the security or integrity of any personal or confidential information. \u003c/li\u003e\n\u003cli\u003eTaking any action that will negatively affect Kroger or its customers.\u003c/li\u003e\n\u003cli\u003eBrute force attacks, Denial of Service attacks (DoS) or Distributed Denial of Services (DDoS) attacks.\u003c/li\u003e\n\u003cli\u003eAttempting to gain physical access to Kroger property or data centers.\u003c/li\u003e\n\u003cli\u003eUse of assets that you do not own or are not authorized or licensed to use when discovering a vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eOut of Scope Vulnerabilities:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eVulnerabilities in third-party applications, websites, or services that integrate with or link to Kroger’s websites or applications.\u003c/li\u003e\n\u003cli\u003eDiscovery of any in-use service (vulnerable 3rd-party code, for example) whose running version includes known vulnerabilities without demonstrating an existing security impact.\u003c/li\u003e\n\u003cli\u003eSocial engineering, phishing, and physical attacks.\u003c/li\u003e\n\u003cli\u003eDoS, DDoS, and brute force attacks.\u003c/li\u003e\n\u003cli\u003eVulnerabilities that only affect significantly out-of-date browsers or mobile devices.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eVulnerability Reporting\u003c/h2\u003e\n\n\u003cp\u003eYou can report a suspected vulnerability by using this webform. We require the technical details and background necessary for our team to identify and validate the reported vulnerability. We ask that you include as much of the below information in your report as possible to help us better understand the nature and scope of the reported vulnerability:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe impacted system, (if known).\u003c/li\u003e\n\u003cli\u003eType and/or class of vulnerability.\u003c/li\u003e\n\u003cli\u003eStep-by-step instructions to reproduce the vulnerability.\u003c/li\u003e\n\u003cli\u003eProof-of-concept or exploit code.\u003c/li\u003e\n\u003cli\u003ePotential impact of the vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003eWe consider any security research conducted in good faith and in compliance with this Policy to be authorized conduct and we will not initiate legal action against you for such security research. If legal action is initiated by a third party against you in connection with such security research, we will take steps to make it known that your actions were authorized and conducted in compliance with this Policy.\u003c/p\u003e\n\n\u003ch2\u003eLegal\u003c/h2\u003e\n\n\u003cp\u003eWe reserve all legal rights in the event of any noncompliance with this Policy.\u003c/p\u003e\n\n\u003cp\u003eKroger may modify this Policy at any time without notice in Kroger’s sole discretion. Please check this page regularly for updates, which are effective upon posting. Kroger may also discontinue its vulnerability disclosure program described in this Policy at any time. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cem\u003eIf you have any questions, please reach out to Bugcrowd Support Portal. (https://bugcrowd-support.freshdesk.com/support/home).\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"5338a3c8-99e3-4e5a-802e-1d42fbfd854e","name":"Grocery Shopping Experience","targets":[{"id":"1996fc75-b291-4d2d-9c45-8f3aa60fd13b","uri":"https://www.fredmeyer.com/","name":"*.fredmeyer.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d18323b7-e0de-4d08-8cda-c3b83ffa89b6","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"1996fc75-b291-4d2d-9c45-8f3aa60fd13b"}],"recentChangeFlags":null},{"id":"367be374-2b36-4503-8f9d-f4d7fc8d5239","uri":"https://www.marianos.com/","name":"*.marianos.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4c74f6d1-9ad4-4406-a11d-97a08fd90a85","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"367be374-2b36-4503-8f9d-f4d7fc8d5239"}],"recentChangeFlags":null},{"id":"68ffd796-a064-4a81-b9ea-6be541e38f27","uri":"https://www.citymarket.com/","name":"*.citymarket.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"426370bc-6086-46c3-9e2d-2e782656e6ea","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"68ffd796-a064-4a81-b9ea-6be541e38f27"}],"recentChangeFlags":null},{"id":"434ffc96-2082-4f87-ae02-7a49d577956e","uri":"https://www.smithsfoodanddrug.com","name":"*.smithsfoodanddrug.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"95c69f54-ba85-4a9a-88f7-ff0891523eaf","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"434ffc96-2082-4f87-ae02-7a49d577956e"}],"recentChangeFlags":null},{"id":"6e3c3ad4-6c15-4eff-835f-528792983db1","uri":"https://www.frysfood.com/","name":"*.frysfood.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9597046f-fdec-4bbe-a296-21cefd8189cf","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"6e3c3ad4-6c15-4eff-835f-528792983db1"}],"recentChangeFlags":null},{"id":"160427f4-b203-4d27-b620-b5d3b5ab76e8","uri":"https://www.picknsave.com/","name":"*.picknsave.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ff0c9e20-2a52-41ee-8cce-cccfdf4b9fa7","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"160427f4-b203-4d27-b620-b5d3b5ab76e8"}],"recentChangeFlags":null},{"id":"6182e73e-facc-4a11-93c4-f27b687e7a3e","uri":"https://www.bakersplus.com/","name":"*.bakersplus.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"97b7d195-6ba9-4201-ad2c-4c97c0418a48","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"6182e73e-facc-4a11-93c4-f27b687e7a3e"}],"recentChangeFlags":null},{"id":"f8fd8fe7-ed59-47d1-b010-dfcf520ccfcf","uri":"https://www.foodsco.net","name":"*.foodsco.net","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3ac15016-886a-4cd4-b6a1-132421584b85","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"f8fd8fe7-ed59-47d1-b010-dfcf520ccfcf"}],"recentChangeFlags":null},{"id":"f1dbc5be-1b28-410e-bd48-149ba73cd2a4","uri":"https://www.rulerfoods.com","name":"*.rulerfoods.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ca904362-651c-4075-88ea-4524fdf3e3bb","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"f1dbc5be-1b28-410e-bd48-149ba73cd2a4"}],"recentChangeFlags":null},{"id":"3a18661b-b3b4-46fa-b991-d6e29033a2ab","uri":"https://www.gerbes.com/","name":"*.gerbes.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a282d88b-cf71-4005-836d-682d3e2b994c","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"3a18661b-b3b4-46fa-b991-d6e29033a2ab"}],"recentChangeFlags":null},{"id":"2b062fcf-ae3d-47de-8259-8314c4e675fb","uri":"https://www.roundys.com","name":"*.roundys.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f55cb5bc-071c-4b8b-a0ba-8e0abf7ce380","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"2b062fcf-ae3d-47de-8259-8314c4e675fb"}],"recentChangeFlags":null},{"id":"1d094391-3864-473f-a3cd-efe46abbc07a","uri":"https://www.ralphs.com/","name":"*.ralphs.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ca113c4f-6319-4e82-90be-4ab80776aa15","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"1d094391-3864-473f-a3cd-efe46abbc07a"}],"recentChangeFlags":null},{"id":"dcd585b0-2cd9-4f31-b92d-62e416fde6b0","uri":"https://kroger.com","name":"www.kroger.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"596933a6-7792-493d-8c31-403c178c7fee","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"dcd585b0-2cd9-4f31-b92d-62e416fde6b0"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"dcd585b0-2cd9-4f31-b92d-62e416fde6b0"}],"recentChangeFlags":null},{"id":"88ed37af-3fe3-4bc4-992e-423ac4d05be9","uri":"https://www.harristeeter.com/","name":"*.harristeeter.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7a511612-bfed-4416-b373-f9d18638f38c","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"88ed37af-3fe3-4bc4-992e-423ac4d05be9"}],"recentChangeFlags":null},{"id":"596958c5-e519-4df6-83ca-496874e13c79","uri":"https://www.qfc.com/","name":"*.qfc.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b4be0fc8-0d59-4e24-a583-f3a9446c180b","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"596958c5-e519-4df6-83ca-496874e13c79"}],"recentChangeFlags":null},{"id":"4aba3306-ee10-46ed-a5c3-587ec3ef5cfa","uri":"https://www.jaycfoods.com","name":"*.jaycfoods.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"26b9d4e9-0e22-469c-bdc3-c2f67bff100c","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"4aba3306-ee10-46ed-a5c3-587ec3ef5cfa"}],"recentChangeFlags":null},{"id":"69102eb8-d0b5-43f9-8ed2-acb87331a5f7","uri":"https://www.dillons.com/","name":"*.dillons.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7eb93f83-306b-474c-b3cc-6f873ea539ad","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"69102eb8-d0b5-43f9-8ed2-acb87331a5f7"}],"recentChangeFlags":null},{"id":"27273bc7-a29a-4121-94e6-ada59ccbf594","uri":"https://www.metromarket.net","name":"*.metromarket.net","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"34a23301-1197-47a7-8ce3-075a404ed025","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"27273bc7-a29a-4121-94e6-ada59ccbf594"}],"recentChangeFlags":null},{"id":"fafcfa78-ec5f-4acd-9961-02a0b19602b5","uri":"https://www.food4less.com/","name":"*.food4less.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5be804f9-5844-4ff7-85bc-07e518407166","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"fafcfa78-ec5f-4acd-9961-02a0b19602b5"}],"recentChangeFlags":null},{"id":"84cf63ea-de59-4e57-af00-8f9ddbb8dcaa","uri":"https://www.kingsoopers.com/","name":"*.kingsoopers.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6d8b5191-a04f-4924-aa30-83e828baad6f","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"84cf63ea-de59-4e57-af00-8f9ddbb8dcaa"}],"recentChangeFlags":null},{"id":"e6bd5305-3604-4d8e-bdb3-4f413531fa1c","uri":"https://www.pay-less.com","name":"*.pay-less.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d108d675-15c2-4d35-bd33-0ee3bd04711b","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"e6bd5305-3604-4d8e-bdb3-4f413531fa1c"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eThe following websites are part of a single backend system. Any vulnerabilities found will be found at each URL. Vulnerability reports submitted on the same vulnerability across different endpoints belonging to Kroger are not eligible for multiple rewards. Multiple reports on the same vulnerability will be considered duplicates. Please submit a single report.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"ac4b16f0-6c66-470b-843f-5a2d5fec2b3f","name":"The Kroger Co.","targets":[{"id":"93e0d1e4-28d9-41c1-b606-6e1ab5b7e9ba","uri":"https://www.krogerrealestate.com/","name":"*.krogerrealestate.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bd6548a2-08b8-41e1-9eaa-7915895a7ec1","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"d89d8bf0-a649-40f2-9650-2553ad3dbaa0","uri":"https://www.krogerprecisionmarketing.com","name":"*.krogerprecisionmarketing.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"80fb5d93-db34-49f1-a143-e7c7fcb87d73","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"e4ed3f9e-9896-4170-aeb6-23a5ff569910","uri":"https://www.mylifeatkroger.com","name":"*.mylifeatkroger.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"901e48c8-fef3-4c36-9d29-c3473d9a4e35","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"50e75230-637f-41d4-b64d-5ab08a4d992c","uri":"https://www.thekrogerco.com","name":"*.thekrogerco.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"771af613-e63d-453d-b930-9d5db73a777e","sortOrder":4},"sortOrder":4,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"50e75230-637f-41d4-b64d-5ab08a4d992c"}],"recentChangeFlags":null},{"id":"c3d58564-a4ae-4348-9f0c-e1d0e255a219","uri":"https://www.thekrogercozerohungerzerowastefoundation.com","name":"*.thekrogercozerohungerzerowastefoundation.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"10dab9c4-94ec-4c5d-b6fd-bf6f639e8b5b","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"28431d1c-af43-408d-a66b-bfe300342918","uri":"https://www.chefschoicecatering.com","name":"*.chefschoicecatering.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"dd0c8c8b-9885-484f-9aca-c8e9a924db0b","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"339f5dbf-b0a9-4b5c-9da4-f489da60dd80","uri":"https://www.kroger.com","name":"*.kroger.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f0c06fcb-e996-4638-adff-a59ae584432c","sortOrder":7},"sortOrder":7,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"339f5dbf-b0a9-4b5c-9da4-f489da60dd80"}],"recentChangeFlags":null},{"id":"7c312c9a-4b98-4db2-ba58-cf86b119cde8","uri":"https://www.votekroger.com","name":"*.votekroger.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"808652a8-26d2-4f3f-a2fa-99f1b89cfcda","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null},{"id":"aa5f5c84-6a94-4ee6-afd0-0e987c31a2ff","uri":"https://www.murrayscheese.com/","name":"*.murrayscheese.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1bc2e870-feac-4c3d-9ded-de3aed7b01c1","sortOrder":9},"sortOrder":9,"tags":null,"recentChangeFlags":null},{"id":"af76f78f-671c-4201-b66a-988bff26c9b1","uri":"https://www.krogerfamilycareers.com","name":"*.krogerfamilycareers.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"56cea3b4-9ee6-4747-88fa-944ae0685a11","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null},{"id":"11545722-5572-4fbe-8469-2d1298d1ce62","uri":"https://www.homechef.com/","name":"*.homechef.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"74f19664-6b47-4d28-9981-fe369e8312e9","sortOrder":11},"sortOrder":11,"tags":null,"recentChangeFlags":null},{"id":"6cc01199-4e4f-4ab4-a909-f51ba0f5ec42","uri":"https://www.krogerprepaid.com","name":"*.krogerprepaid.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ca3f536b-20e9-4a44-88ed-e5260e1fec76","sortOrder":12},"sortOrder":12,"tags":null,"recentChangeFlags":null},{"id":"861a275b-987a-4a0f-9a3c-dff7770a44bc","uri":"https://www.fredmeyerjewelers.com/","name":"*.fredmeyerjewelers.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c1137aef-6f29-40bd-a7d8-31afdcadade6","sortOrder":13},"sortOrder":13,"tags":null,"recentChangeFlags":null},{"id":"9acaf33a-49b4-4999-b76c-f9e8d39ecdd5","uri":"https://www.krogerwireless.com/","name":"*.krogerwireless.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"01313280-bfcf-4d0b-8f15-ebc672e0e9e0","sortOrder":14},"sortOrder":14,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThese targets are part of The Kroger Co. but are not part of the same backend system. \u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"cad31284-ae78-4551-bccd-2a983bfcfd7c","name":"Health \u0026 Wellness","targets":[{"id":"a0673547-d961-474c-90b3-d7d873c5ba7e","uri":"https://www.krogerschedule.com","name":"*.krogerschedule.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"737fdd32-8bc4-4964-8a5d-fb23a220c389","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"088ce148-1954-4199-870c-11df90634052","uri":"https://www.krogerhealth.com","name":"*.krogerhealth.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d38977bc-b963-4b4b-80ce-0d405f14e44d","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"088ce148-1954-4199-870c-11df90634052"}],"recentChangeFlags":null},{"id":"f74532d2-50ef-4204-b799-41e90ab1502e","uri":"https://www.thelittleclinic.com","name":"*.thelittleclinic.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2a6f227c-3626-4204-b52e-4f66e5410990","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"f74532d2-50ef-4204-b799-41e90ab1502e"}],"recentChangeFlags":null},{"id":"3c4d0490-3951-4f32-8ea6-19e78a87ae51","uri":"https://www.ppsrx.com","name":"*.ppsrx.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"32a666e9-99d3-41db-955f-373f85faf1e8","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"3c4d0490-3951-4f32-8ea6-19e78a87ae51"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThese targets are part of The Kroger Co.\u0026#39;s Health and Wellness division. \u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"97cac0cd-9608-4407-bfa8-8ca546ccbf26","name":"8451","targets":[{"id":"c183550f-6603-4e01-be1c-bf7593a72aee","uri":"https://www.8451.com","name":"*.8451.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"86fadccd-c7e1-44c5-8fae-51956e5f3880","sortOrder":1},"sortOrder":1,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"c183550f-6603-4e01-be1c-bf7593a72aee"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"3664c735-4e6a-4ac3-b28d-42eed282f20c","name":"API/Webservices","targets":[{"id":"382d1f00-73b1-40b7-a03b-6851d4166b9a","uri":"https://api.kroger.com","name":"api.kroger.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4659d668-56ce-450b-a600-e0257207d713","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"382d1f00-73b1-40b7-a03b-6851d4166b9a"}],"recentChangeFlags":null},{"id":"f145191d-a33e-4520-bb12-b5a2a03faf11","uri":"https://api.8451.com","name":"api.8451.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"aee38dbd-9d03-4042-96d3-a0a309d81a1b","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"f145191d-a33e-4520-bb12-b5a2a03faf11"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":4,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eWebservices endpoints.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"9ec36cdc-9f97-409d-b06f-d8932bc67260","name":"Out of Scope","targets":[{"id":"a5ef49e9-9e2a-491c-a6c7-4045acf8c0ea","uri":"","name":"*/hc/help/contact-us","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c368b14e-7e88-4dbd-b370-2e5ff67671a7","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"19d4039e-856c-4a4c-bebd-76d1282a984f","uri":"https://www.fredmeyerjewelers.com/service/content/emailus.aspx","name":"https://www.fredmeyerjewelers.com/service/content/emailus.aspx","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"969e39db-052b-4d81-9fba-a9f21859d827","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"92397b10-69f9-4b6f-8c6a-9a549b56ab07","uri":"https://www.8451.com/contact-us/","name":"https://www.8451.com/contact-us/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"400a8e5f-6610-4c3a-8cee-9d1d375e4d32","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c480e56c-18a3-40f2-bcb3-861f436c02a2","uri":"","name":"Any contact, signup, request form","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cf1aeab1-a15b-4c98-8751-dc7a8851a9ea","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":5,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"3c1d9d1d-e88d-4a8e-98c5-c8669145e46f","code":"kroger-vdp","state":"in_progress","endsAt":null,"bountyId":"002c2f90-b565-42cf-8e5a-cd84aa467d7b","startsAt":"2024-02-22T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/19c3/da7b/225fcd47/4d73302b9fb887479207a5abc79751c1_kroger_logo.jpeg","logoBackgroundColor":"#FFFFFF","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-02-22T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/kroger-vdp","changelogs":"/engagements/kroger-vdp/changelog","submissions":null,"announcements":"/engagements/kroger-vdp/announcements","hallOfFame":"/engagements/kroger-vdp/hall_of_fames","crowdstream":"/engagements/kroger-vdp/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/kroger-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=kroger-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/kroger-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/kroger-vdp/changelog","publishedAt":"2026-09-08T16:42:45.469Z","engagementChangelogUrl":"/engagements/kroger-vdp/changelog/f7ab1882-c840-4d13-9bf5-2022c4474030","createUserFeedbacksUrl":"/engagements/kroger-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/kroger-vdp/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}