{"id":"3bacc2c8-b454-443d-a32f-4d9c474ebca6","engagementId":"3515cb48-18df-4bee-aed1-4123d356e52b","data":{"brief":{"id":"32553774-04fc-49a9-a8d9-6feec57839d6","name":"LastPass","tagline":"LastPass is a password manager and form filler which locally encrypts your sensitive data with a key that is not sent to LastPass","description":"\u003cp\u003eLastPass is a leading identity and password manager, making it easier to log in to life and work. Trusted by 100,000 businesses and millions of users, LastPass combines advanced security with effortless access for individuals, families, small business owners, and enterprise professionals. As an extended effort to make LastPass as secure as possible, we invite security researchers to contribute to this goal. Take part in our initiative to create a safer digital landscape. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of LastPass not listed in the targets section is out of scope.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eProgram Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eFor researchers, enterprise features are also in scope of this bounty program. Targeting that part of the application will require you to create an enterprise or teams trial account. More information about the free trial \u003ca href=\"https://lastpass.com/enterprise_trial.php?createacct=1\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecan be found here\u003c/a\u003e.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIf you are an Enterprise customer of LastPass who believes they have discovered a potential vulnerability or security concern, we kindly ask you to contact your assigned Customer Success Manager or Customer Relationship Manager instead of submitting a submission to Bugcrowd. Customers can also \u003ca href=\"https://support.lastpass.com/s/document-item?language=en_US\u0026amp;bundleId=lastpass\u0026amp;topicId=LastPass/contact-support.html\u0026amp;_LANG=enus\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esubmit a support ticket here\u003c/a\u003e or report it via email to \u003ca href=\"mailto:securitydisclosure@lastpass.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esecuritydisclosure@lastpass.com\u003c/a\u003e, where it will be escalated to the threat intelligence team. \u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eCommunication with our security team should happen via Bugcrowd. From the submission of the issue until closing it, we will use Bugcrowd to communicate about the progress.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWhen using automated tools, the requests should be limited to a \u003cstrong\u003emaximum of 5 requests per second\u003c/strong\u003e. We kindly request participants to adhere to this rate in order to ensure smooth collaboration.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003ePublic Disclosure\u003c/h2\u003e\n\n\u003cp\u003eOur policy for disclosing vulnerabilities aligns with the \u003cstrong\u003e\"Coordinated Disclosure\"\u003c/strong\u003e policy mentioned in \u003ca href=\"https://docs.bugcrowd.com/researchers/disclosure/disclosure/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd's Public Disclosure Policy\u003c/a\u003e. Researchers are allowed to publish mutually agreed information about the vulnerability after it has been fixed. Before publishing, please provide a draft of the publication for our review in the submission's comment section.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAcceptance Criteria\u003c/h2\u003e\n\n\u003cp\u003eOur acceptance criteria for submissions follow \u003ca href=\"https://www.bugcrowd.com/resources/essentials/standard-disclosure-terms/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd's Standard Disclosure Terms\u003c/a\u003e.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eTesting must be performed only on systems listed under the program brief 'In scope targets' section. Any other systems are Out-of-Scope.\u003c/li\u003e\n\u003cli\u003eThe submission must not be a part of the excluded submission types list.\u003c/li\u003e\n\u003cli\u003eYou must create accounts for testing purposes.\u003c/li\u003e\n\u003cli\u003eOnly the first researcher to submit the vulnerability will be eligible for a reward.\u003c/li\u003e\n\u003cli\u003eCommunication regarding submissions must remain within Bugcrowd and/or official Bugcrowd support channels for the duration of the disclosure process.\u003c/li\u003e\n\u003cli\u003eActions which affect the integrity or availability of program targets are prohibited. If you notice performance degradation on the target systems, you must immediately suspend all use of automated tools.\u003c/li\u003e\n\u003cli\u003eSubmissions must be related to the security posture of the target. In order to demonstrate its impact, your description should include a realistic scenario of a possible way to exploit the weakness you found. In case of debates, researchers might be asked to defend the impact in order to qualify for a reward. Bugs with no security implications will not be accepted.\u003c/li\u003e\n\u003cli\u003eWe require Researchers to include a video or screenshot Proof-of-Concept in their submissions demonstrating the vulnerability step-by-step. For more details, please refer to \u003ca href=\"https://docs.bugcrowd.com/researchers/reporting-managing-submissions/reporting-a-bug/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd's Reporting a Bug\u003c/a\u003e documentation.\n\n\u003cul\u003e\n\u003cli\u003eThese files must not be shared publicly on sites like YouTube, Imgur, Dropbox and others under any circumstances.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eViolation of a program's stated disclosure policy will result in enforcement action as outlined in the \u003ca href=\"https://www.bugcrowd.com/resources/essentials/standard-disclosure-terms/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd's Standard Disclosure Terms\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDenial of service, spam, or phishing attacks.\u003c/li\u003e\n\u003cli\u003eAttacks only possible on jailbroken or rooted mobile devices.\u003c/li\u003e\n\u003cli\u003eAttacks that would require Man-in-the-Middle (MitM) situations.\u003c/li\u003e\n\u003cli\u003eMemory dumps or issues found by tools that read active or cached memory.\u003c/li\u003e\n\u003cli\u003eLinks that are indexed by Google, URL scan sites and publicly available information.\u003c/li\u003e\n\u003cli\u003eWebsite-documented sharing limitations are out-of-scope due to inherent technical constraints. \u003ca href=\"https://support.lastpass.com/s/document-item?language=en_US\u0026amp;_LANG=enus\u0026amp;bundleId=lastpass\u0026amp;topicId=LastPass%2FUse_the_Sharing_Center.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ePlease refer to our site for specific exclusions\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eBroken client-side access control mechanisms. While always helpful and appreciated to be reported on, client-side mechanisms generally run in an environment that is out of our control.\u003c/li\u003e\n\u003cli\u003eExclusions include \"missing\" security practices without viable attack scenarios or critiques of design choices. Submissions should focus on realistic threats with user impact, rather than emerging or theoretical best practices.\u003c/li\u003e\n\u003cli\u003eAttacks against endpoints which enable username enumeration or brute forcing of credentials (for example login forms) when those endpoints already have reasonable rate limits in place. Distributed attacks using multiple IP addresses are also excluded.\u003c/li\u003e\n\u003cli\u003eAttacks performed by a malicious application or browser extension installed on the system. On mobile we accept issues exploited by apps with limited privileges (e.g., if an app without any special permission could read the unencrypted passwords, that would typically be in scope).\u003c/li\u003e\n\u003cli\u003eTwo-Factor Authentication (2FA) bypass for loading the user's local offline cache. If the user's settings enabled offline access for 2FA and if the user has previously logged into the device, offline mode will override and bypass the required 2FA and allow the autofill access. This will not occur if the login is performed on a new device.\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":"\u003cp\u003e\u0026lt;b\u0026gt;This bounty requires explicit permission to disclose the results of a submission.\u0026lt;/b\u0026gt;\u003c/p\u003e"},"scope":[{"id":"a2f0d080-883b-4bfe-89fb-5ca1884e4470","name":"In Scope Targets","targets":[{"id":"3d4d78dc-6b1f-47e0-abc6-e66e6e8584a5","uri":"https://lastpass.com","name":"https://lastpass.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"453b6d09-ffa6-40f4-88d3-4865db295055","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"3d4d78dc-6b1f-47e0-abc6-e66e6e8584a5"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"3d4d78dc-6b1f-47e0-abc6-e66e6e8584a5"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"3d4d78dc-6b1f-47e0-abc6-e66e6e8584a5"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"3d4d78dc-6b1f-47e0-abc6-e66e6e8584a5"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"3d4d78dc-6b1f-47e0-abc6-e66e6e8584a5"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"3d4d78dc-6b1f-47e0-abc6-e66e6e8584a5"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"3d4d78dc-6b1f-47e0-abc6-e66e6e8584a5"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"3d4d78dc-6b1f-47e0-abc6-e66e6e8584a5"}],"recentChangeFlags":null},{"id":"83055a57-4a9e-4eed-8eb5-520a6787dd0a","uri":"https://lastpass.com/misc_download2.php","name":"LastPass browser extensions (Chrome / Safari / Edge / Firefox)","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7ae94805-0fcf-4116-afea-a4d526e17107","sortOrder":0},"sortOrder":0,"tags":[{"id":"59791207-9cf4-4498-b5e1-510fee95dc40","name":"Browser Extension","targetId":"83055a57-4a9e-4eed-8eb5-520a6787dd0a"}],"recentChangeFlags":null},{"id":"1625e8e6-5334-4c32-8798-9138efbfeb90","uri":"https://lastpass.com/misc_download2.php","name":"Local computer apps (UWP application / Windows installer (MSI) / MacOS)","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"aa7cbb91-bff4-4d7b-9212-45854f39dd4e","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"b11c2d28-fda9-4a25-8f36-cfe653023275","uri":"https://support.lastpass.com","name":"https://support.lastpass.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1e2dd05c-0baf-4ca8-ac8a-ca947987bd8f","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"b11c2d28-fda9-4a25-8f36-cfe653023275"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"b11c2d28-fda9-4a25-8f36-cfe653023275"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"b11c2d28-fda9-4a25-8f36-cfe653023275"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"b11c2d28-fda9-4a25-8f36-cfe653023275"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"b11c2d28-fda9-4a25-8f36-cfe653023275"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"b11c2d28-fda9-4a25-8f36-cfe653023275"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"b11c2d28-fda9-4a25-8f36-cfe653023275"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"b11c2d28-fda9-4a25-8f36-cfe653023275"}],"recentChangeFlags":null},{"id":"adcfeb36-a0d4-460f-bb1a-7c3645c5c51b","uri":"","name":"Workstation MFA (WMFA)","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d2a06219-f7b6-4e04-b22f-d0c470a02da0","sortOrder":0},"sortOrder":0,"tags":[{"id":"59cdb1e5-8e65-4040-b1eb-c323dfee5a53","name":"Authentication Systems","targetId":"adcfeb36-a0d4-460f-bb1a-7c3645c5c51b"}],"recentChangeFlags":null},{"id":"4985c156-e174-4a05-8e90-3230013ce15d","uri":"https://blog.lastpass.com","name":"https://blog.lastpass.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e31214ec-c6ed-49c5-a405-36fe8edebabf","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"4985c156-e174-4a05-8e90-3230013ce15d"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"4985c156-e174-4a05-8e90-3230013ce15d"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"4985c156-e174-4a05-8e90-3230013ce15d"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"4985c156-e174-4a05-8e90-3230013ce15d"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"4985c156-e174-4a05-8e90-3230013ce15d"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"4985c156-e174-4a05-8e90-3230013ce15d"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"4985c156-e174-4a05-8e90-3230013ce15d"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"4985c156-e174-4a05-8e90-3230013ce15d"}],"recentChangeFlags":null},{"id":"3a5710a0-ae3f-413a-81bd-cb75b9df17fe","uri":"https://admin.lastpass.com","name":"https://admin.lastpass.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4782db66-cfee-429c-bd83-022dcde0aacc","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"3a5710a0-ae3f-413a-81bd-cb75b9df17fe"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"3a5710a0-ae3f-413a-81bd-cb75b9df17fe"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"3a5710a0-ae3f-413a-81bd-cb75b9df17fe"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"3a5710a0-ae3f-413a-81bd-cb75b9df17fe"}],"recentChangeFlags":null},{"id":"ace59271-a383-4c44-9978-eecf0a3167c5","uri":"https://auth.lastpass.com","name":"https://auth.lastpass.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f0bd4ffc-0560-4d41-a490-4a5c5e72214b","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"1bac9de5-07d5-41e8-8ce9-eb132b9ec1fd","uri":"https://accounts.lastpass.com","name":"https://accounts.lastpass.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"49d19d06-3259-4e47-8b9a-a79e8cfd1a3e","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"1bac9de5-07d5-41e8-8ce9-eb132b9ec1fd"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"1bac9de5-07d5-41e8-8ce9-eb132b9ec1fd"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"1bac9de5-07d5-41e8-8ce9-eb132b9ec1fd"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"1bac9de5-07d5-41e8-8ce9-eb132b9ec1fd"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"1bac9de5-07d5-41e8-8ce9-eb132b9ec1fd"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"1bac9de5-07d5-41e8-8ce9-eb132b9ec1fd"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"1bac9de5-07d5-41e8-8ce9-eb132b9ec1fd"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"1bac9de5-07d5-41e8-8ce9-eb132b9ec1fd"}],"recentChangeFlags":null},{"id":"dbadba57-2460-4e0e-af93-117379ee26ff","uri":"https://www.lastpass.com","name":"https://www.lastpass.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"023b85a5-63e2-4517-ae61-b6a90357af83","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"f7af0922-9325-4f19-842f-52c40a5dbf1c","p1MaxCents":500000,"p1MinCents":220000,"p2MaxCents":220000,"p2MinCents":60000,"p3MaxCents":60000,"p3MinCents":15000,"p4MaxCents":15000,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2200,"max":5000},"2":{"min":600,"max":2200},"3":{"min":150,"max":600},"4":{"min":0,"max":150},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"e04605cd-003f-4461-92db-d4d22d1c66d5","name":"Mobile Targets","targets":[{"id":"38804e9d-8f05-4ea2-8b1b-b18931ea0f33","uri":"https://play.google.com/store/apps/details?id=com.lastpass.lpandroid","name":"LastPass Password Manager (Android)","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0bd457fe-a3f4-4777-aa0d-ac45ade2159b","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"38804e9d-8f05-4ea2-8b1b-b18931ea0f33"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"38804e9d-8f05-4ea2-8b1b-b18931ea0f33"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"38804e9d-8f05-4ea2-8b1b-b18931ea0f33"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"38804e9d-8f05-4ea2-8b1b-b18931ea0f33"}],"recentChangeFlags":null},{"id":"f6ef004e-577f-4962-8d02-d54f356331ca","uri":"https://play.google.com/store/apps/details?id=com.lastpass.authenticator\u0026hl=en_US\u0026gl=US","name":"LastPass Authenticator (Android)","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f5ec8d96-b7e0-4c58-b1ab-4bbd64bacbe8","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"f6ef004e-577f-4962-8d02-d54f356331ca"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"f6ef004e-577f-4962-8d02-d54f356331ca"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"f6ef004e-577f-4962-8d02-d54f356331ca"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"f6ef004e-577f-4962-8d02-d54f356331ca"}],"recentChangeFlags":null},{"id":"1e67952a-f219-4852-9551-a0b56e84b13f","uri":"https://apps.apple.com/us/app/lastpass-password-manager/id324613447","name":"LastPass Password Manager (iOS)","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f896c069-96b2-4336-ac2b-f69edf49edf3","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"1e67952a-f219-4852-9551-a0b56e84b13f"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"1e67952a-f219-4852-9551-a0b56e84b13f"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"1e67952a-f219-4852-9551-a0b56e84b13f"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"1e67952a-f219-4852-9551-a0b56e84b13f"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"1e67952a-f219-4852-9551-a0b56e84b13f"}],"recentChangeFlags":null},{"id":"e0a9f443-c61a-4951-bf0d-0cd8e3d3994d","uri":"https://apps.apple.com/us/app/lastpass-authenticator/id1079110004","name":"LastPass Authenticator (iOS)","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"157d27f3-2eb3-45ba-b866-746c93ec0b0c","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"e0a9f443-c61a-4951-bf0d-0cd8e3d3994d"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"e0a9f443-c61a-4951-bf0d-0cd8e3d3994d"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"e0a9f443-c61a-4951-bf0d-0cd8e3d3994d"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"e0a9f443-c61a-4951-bf0d-0cd8e3d3994d"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"e0a9f443-c61a-4951-bf0d-0cd8e3d3994d"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"f7af0922-9325-4f19-842f-52c40a5dbf1c","p1MaxCents":500000,"p1MinCents":220000,"p2MaxCents":220000,"p2MinCents":60000,"p3MaxCents":60000,"p3MinCents":15000,"p4MaxCents":15000,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2200,"max":5000},"2":{"min":600,"max":2200},"3":{"min":150,"max":600},"4":{"min":0,"max":150},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"664efe0b-1c2b-4a91-9063-8429d925e841","name":"Out of Scope Targets","targets":[{"id":"575f1ec2-2d38-45ef-ba94-6791be814d33","uri":null,"name":"https://identity.lastpass.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1ff25644-841d-47c2-a65a-6bf0c2d0c1ac","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"575f1ec2-2d38-45ef-ba94-6791be814d33"}],"recentChangeFlags":null},{"id":"8901dd12-8e75-4edd-9eaf-f350ba6e5f8e","uri":null,"name":"Lastpass CLI tool","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6fb831f7-21f2-4859-84b1-aa0f27e91511","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"f799afc7-2e88-40e1-a8a4-e0b148797f65","uri":"","name":"https://info.lastpass.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"60787156-2315-4429-9c7c-12b2d94c7b75","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"4e34e3e3-f120-47d3-9b2b-835752585b22","uri":"","name":"https://forums.lastpass.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a3a0f361-3eff-4304-85de-6b37222f0cf7","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"4e34e3e3-f120-47d3-9b2b-835752585b22"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"4e34e3e3-f120-47d3-9b2b-835752585b22"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"4e34e3e3-f120-47d3-9b2b-835752585b22"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"4e34e3e3-f120-47d3-9b2b-835752585b22"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"4e34e3e3-f120-47d3-9b2b-835752585b22"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"4e34e3e3-f120-47d3-9b2b-835752585b22"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"4e34e3e3-f120-47d3-9b2b-835752585b22"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"4e34e3e3-f120-47d3-9b2b-835752585b22"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"3515cb48-18df-4bee-aed1-4123d356e52b","code":"lastpass","state":"in_progress","endsAt":null,"bountyId":"25ccbb59-bacb-4090-8462-6640daaab1a1","startsAt":"2016-10-03T14:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/37fa/45ee/345b0907/641146a43d90320e3c759367adf7508f_Color_LP.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2016-10-03T14:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/lastpass","changelogs":"/engagements/lastpass/changelog","submissions":null,"announcements":"/engagements/lastpass/announcements","hallOfFame":"/engagements/lastpass/hall_of_fames","crowdstream":"/engagements/lastpass/crowdstream"},"announcementsCount":6,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/lastpass/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=lastpass\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/lastpass/engagement_subscribers","engagementChangelogsUrl":"/engagements/lastpass/changelog","publishedAt":"2026-03-11T12:13:59.447Z","engagementChangelogUrl":"/engagements/lastpass/changelog/3bacc2c8-b454-443d-a32f-4d9c474ebca6","createUserFeedbacksUrl":"/engagements/lastpass/feedbacks","engagementCrowdstreamUrl":"/engagements/lastpass/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}