{"id":"75a57d34-9894-4750-bc84-f6937a266609","engagementId":"2d654155-0912-419f-b7c6-a860f538fa9d","data":{"brief":{"id":"55c5f00c-a56e-4a8c-ae26-f81001892fc6","name":"Lime","tagline":"Help secure Lime","description":"\u003cp\u003eWelcome to Lime’s Bug Bounty program! Lime is an urban transportation leader that offers mobility services, including scooters and bikes. Our mission is to develop the most advanced micro mobility solution that empowers humans to take one step towards becoming carbon neutral. Lime has three customer profiles that we cater: \u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003eRiders, this customer is using Lime products to commute from point A to point B.\u003c/li\u003e\n\u003cli\u003eOperators, this customer makes sure our fleet of vehicles is always functioning to serve the riders. There are three major categories of operators at Lime:\n\n\u003cul\u003e\n\u003cli\u003eOperators: These people are Lime employees who perform in-warehouse tasks to repair and maintain the fleet\u003c/li\u003e\n\u003cli\u003eLogistics Partner: This a contracting agency that Lime uses to partner with during peak season for fluctuating operational demands \u003c/li\u003e\n\u003cli\u003eJuicers: These are independent contractors that perform out-of-warehouse tasks to get paid through the Juicer app\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eCities, this customer provides Lime the opportunity to serve the customers of that city. The city provides a region to Lime where they can operate in also provides certain requirements like No-operation zones(NOZ) [you might have noticed the speed of scooters and bike drop in certain areas], No-parking zones you might have seen dedicated parking spots in some cities], Safety requirements etc. They require Lime to submit heatmaps to help them in city planning along with other Government relations requirements.\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003eWe're looking for passionate and driven researchers who are excited to join us in our pursuit of revolutionizing the way humans try to save the planet. With access to state-of-the-art technology and a highly collaborative team, you'll have the opportunity to explore groundbreaking ideas and make a real impact in this exciting and rapidly evolving field of micromobility. \u003c/p\u003e\n\n\u003cp\u003eLime values the work done by security researchers in improving the security of our products and service offerings. We are committed to working with this community to verify, reproduce, and respond to legitimate reported vulnerabilities. We encourage the community to participate in our responsible reporting process. We will coordinate and communicate with researchers through the bug bounty process.\u003c/p\u003e\n\n\u003cp\u003eGood luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eEligibility\u003c/h2\u003e\n\n\u003cp\u003eNote that Lime's Bug Bounty program is in part facilitated through a third party (Bugcrowd) that performs additional services and eligibility checks on our behalf. For example, Lime may not issue payments if one or more of the following is applicable:\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003eYou are a resident of a country under U.S. sanctions or live in a country that prohibits this type of program.\u003c/li\u003e\n\u003cli\u003eYou are currently (or were in the last 6 months) an employee of Lime, a Lime subsidiary, or a third-party contractor with access to Lime’s internal systems and networks.\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization and rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. Internally, Lime will use a CVSS 3.0 score to determine the severity of the vulnerability, the overall risk is determined by the Severity of the vulnerability, ease of exploitation, and business impact on Lime. The severity/Vulnerability rating only determines the “Severity of the vulnerability”. The overall risk rating can be different from the severity rating of the vulnerability. If the risk rating is reduced after Bugcrowd triage, the Lime security team will provide a detailed explanation as to why they made the change.\u003c/p\u003e","industryTagId":"2bf483dc-2f0b-4e2d-b7f0-568b8cc28809","targetsOverview":"\u003cp\u003eActive testing is only authorized on the targets listed as In-Scope. If you believe you have identified a severe vulnerability on a Lime system outside the scope, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e to inquire.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eAccounts can be provisioned where signup is available using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. Some of the targets will NOT have a user signup or registration process. This means it is for internal use only.  Targets have been divided into Public In-Scope, Private In-Scope, and Out-of-Scope. These targets represent the current state and may be moved from one category to another determined by Lime's security team. This program is dedicated to perceived online security issues that may affect many people on Lime. If you're having issues related to your individual account, please visit our \u003ca href=\"https://help.li.me/hc/en-us\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHelp Center\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eYou can self-register for the Lime Rider/Juicer apps which are found on:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e  \u003ca href=\"https://apps.apple.com/us/app/lime-your-ride-anytime/id1199780189\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eApp Store\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003e  \u003ca href=\"https://play.google.com/store/apps/details?id=com.limebike\u0026amp;hl=en_US\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGoogle Play\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRules of Engagement\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eResearch must be done using your own Lime account on products that you own. You should not intentionally modify online accounts, data or products owned by other Lime customers (without explicit permission). If during the course of your research, you find a vulnerability that would allow you to bypass an authentication control for another person’s account, you should report the vulnerability to Lime immediately and take no further action.\u003c/li\u003e\n\u003cli\u003eIf you are able to access or modify the personal data of other customers or other sensitive data that does not belong to you, immediately contact Lime. Do not attempt to conduct post-exploitation work with this data.\u003c/li\u003e\n\u003cli\u003eWhere you are able to access data that does not belong to you, you will be asked to delete it. You must comply with this request, demonstrate the steps you took to ensure it was deleted and confirm deletion to Lime in order to be eligible for a reward.\u003c/li\u003e\n\u003cli\u003eDo not attempt to use brute force or denial of service attacks on Lime-owned systems without prior written approval.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eLime's public-facing applications\u003c/li\u003e\n\u003cli\u003eVulnerabilities in other applications owned by Lime\u003c/li\u003e\n\u003cli\u003eVulnerabilities we don’t already know about\u003c/li\u003e\n\u003cli\u003eThe quality of a submission that makes Lime’s security engineers' job easier will result in a higher bounty in the category. \n\n\u003cul\u003e\n\u003cli\u003e Visual POC with code and video of screen share to reproduce\u003c/li\u003e\n\u003cli\u003eDetailed attacker following MITRE attack framework \u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eFocus on impact. Minor misconfiguration alone does not qualify for rewards.\u003c/li\u003e\n\u003cli\u003eFor 0-day issues, we aim at patching within 30 days. Reports within 30 days of vulnerability release may not be rewarded. We have decided now that we will reward for CVEs with a score of 9.5 and higher if not patched within a week (5 business days) of being added to NVD or GHSA (Github security advisory). \u003c/li\u003e\n\u003cli\u003eFor vulnerability of a vendor (for example, Zendesk, Hubspot), please report to the vendor directly to avoid double reporting.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eCookie flags on \u003ccode\u003ewebview.lime.bike\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003e\"secret\" keys exposed in iOS/Android builds that we do not consider secret\u003c/li\u003e\n\u003cli\u003eAttacks that require unauthorized access to users' clients (phones, browsers, etc)\u003c/li\u003e\n\u003cli\u003eZero-day vulnerabilities (CVEs being added to NVD or GHSA (Github security advisory) with a score of 9.5 or lower) that are less than 30 days old. \u003c/li\u003e\n\u003cli\u003eAndroid debugging enabled\u003c/li\u003e\n\u003cli\u003eLime account MFA issues are out of scope at the present time\u003c/li\u003e\n\u003cli\u003eWAF bypass\u003c/li\u003e\n\u003cli\u003eOpen redirects / Lack of security speedbump when leaving the site (no immediate credential leak)\u003c/li\u003e\n\u003cli\u003eInternal IP address disclosure\u003c/li\u003e\n\u003cli\u003eAccessible Non-sensitive files and directories (e.g. README.TXT, CHANGES.TXT, robots.txt, .gitignore, WSDL, pprof, etc.)\u003c/li\u003e\n\u003cli\u003eSocial engineering / phishing attacks\u003c/li\u003e\n\u003cli\u003eSelf XSS\u003c/li\u003e\n\u003cli\u003eText injection\u003c/li\u003e\n\u003cli\u003eEmail spoofing (including SPF, DKIM, DMARC, From: spoofing, and visually similar, and related issues)\u003c/li\u003e\n\u003cli\u003eDescriptive error messages (e.g. stack traces, application or server errors, path disclosure)\u003c/li\u003e\n\u003cli\u003eFingerprinting/banner disclosure on common/public services\u003c/li\u003e\n\u003cli\u003eClickjacking and issues only exploitable through clickjacking\u003c/li\u003e\n\u003cli\u003eCSRF issues that don't impact the integrity of an account (e.g. log-in or out, contact forms, and other publicly accessible forms)\u003c/li\u003e\n\u003cli\u003eLack of Secure and HTTPOnly cookie flags (critical systems may still be in scope)\u003c/li\u003e\n\u003cli\u003eLack of rate limiting\u003c/li\u003e\n\u003cli\u003eLogin or Forgot Password page brute force, account lockout not enforced, or insufficient password strength requirements\u003c/li\u003e\n\u003cli\u003eHTTPS mixed content scripts\u003c/li\u003e\n\u003cli\u003eUsername/email enumeration by brute forcing/error messages (e.g. login/signup / forgotten password)\u003c/li\u003e\n\u003cli\u003eExceptional cases may still be in scope (e.g. ability to enumerate email addresses via incrementing a numeric parameter)\u003c/li\u003e\n\u003cli\u003eMissing HTTP security headers\u003c/li\u003e\n\u003cli\u003eTLS/SSL Issues, including BEAST BREACH, insecure renegotiation, bad cipher suite, expired certificates, etc.\u003c/li\u003e\n\u003cli\u003eDenial of Service attacks\u003c/li\u003e\n\u003cli\u003eOut-of-date software\u003c/li\u003e\n\u003cli\u003eUse of a known-vulnerable component (exceptional cases, such as where you are able to provide proof of exploitation, may still be in scope)\u003c/li\u003e\n\u003cli\u003ePhysical attacks against Lime's Facilities / Property / Assets \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e for clarification before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":"\u003ch2\u003eResponsible Disclosure Guidelines\u003c/h2\u003e\n\n\u003cp\u003eWe will investigate legitimate reports and make every effort to quickly correct any vulnerability. To encourage responsible reporting, we will not take legal action against you nor ask law enforcement to investigate you, so long as you comply with the Terms.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not access or modify data that does not belong to you. If you are able to gain access to or modify data that belongs to Lime, other customers, or Lime vendors during the course of your research, you must take the following actions:\n\n\u003cul\u003e\n\u003cli\u003eImmediately stop your activities,\u003c/li\u003e\n\u003cli\u003eDisclose your findings to Lime as soon as possible (but no later than 24 hours after discovery). Your findings should include details of the vulnerability, including information needed to reproduce and validate the vulnerability and a Proof of Concept (POC),\u003c/li\u003e\n\u003cli\u003eWait for further instructions from the Lime team.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eMake a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.\u003c/li\u003e\n\u003cli\u003eGive Lime a reasonable time to correct the issue before making any information public. In certain circumstances, Lime may request that you not disclose your findings or to delay disclosure until we can ensure that the matter has been adequately addressed. You may not disclose confirmed, unresolved vulnerabilities without approval from Lime.\u003c/li\u003e\n\u003c/ul\u003e"},"scope":[{"id":"9479240f-04cd-47a2-a262-ad609c963663","name":"Public In-Scope","targets":[{"id":"22bcbe05-ec9b-4108-a7cd-372dea51c69e","uri":null,"name":"proxy-production.lime.bike","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4a4af781-f34b-4c51-87bd-ef1e16beaadc","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"22bcbe05-ec9b-4108-a7cd-372dea51c69e"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"22bcbe05-ec9b-4108-a7cd-372dea51c69e"}],"recentChangeFlags":null},{"id":"c23fb629-9dfa-46e8-b13a-24007c746ce3","uri":"","name":"web-message.lime.bike","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d374ddc0-819b-4a03-90b2-06d7be34c5ff","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c23fb629-9dfa-46e8-b13a-24007c746ce3"}],"recentChangeFlags":null},{"id":"ffd56e99-9576-4786-ab7e-f9d9ed05865f","uri":"","name":"web-message-high.lime.bike","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"87d64502-2d83-4fd8-a56a-5f8159346a5e","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"ffd56e99-9576-4786-ab7e-f9d9ed05865f"}],"recentChangeFlags":null},{"id":"fc9a21c7-25e9-477e-a13f-40d48a4d7895","uri":"https://apps.apple.com/ca/app/lime-supply/id1620058457","name":"Supply iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fc8585d5-4ce7-4527-b5e7-34ccb498f0ac","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"fc9a21c7-25e9-477e-a13f-40d48a4d7895"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"fc9a21c7-25e9-477e-a13f-40d48a4d7895"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"fc9a21c7-25e9-477e-a13f-40d48a4d7895"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"fc9a21c7-25e9-477e-a13f-40d48a4d7895"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"fc9a21c7-25e9-477e-a13f-40d48a4d7895"}],"recentChangeFlags":null},{"id":"d557f074-a28b-422c-a391-e189b7c4f35b","uri":"","name":"web-production.lime.bike","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"77201178-48b3-4fa4-aa11-87157e53f28d","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d557f074-a28b-422c-a391-e189b7c4f35b"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"d557f074-a28b-422c-a391-e189b7c4f35b"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"d557f074-a28b-422c-a391-e189b7c4f35b"}],"recentChangeFlags":null},{"id":"67e69021-039a-4a40-bc23-c6ee4a0fa3ec","uri":null,"name":"external-api.lime.bike","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fc5ffa2c-bca0-4795-b557-101e69db908a","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"67e69021-039a-4a40-bc23-c6ee4a0fa3ec"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"67e69021-039a-4a40-bc23-c6ee4a0fa3ec"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"67e69021-039a-4a40-bc23-c6ee4a0fa3ec"}],"recentChangeFlags":null},{"id":"6d21a4d2-3ef2-415a-a6cf-acfbd9cab36c","uri":"","name":"Data.lime.bike ","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2d6abfe1-3d0e-4b95-ba3b-782fffa39b0a","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"6d21a4d2-3ef2-415a-a6cf-acfbd9cab36c"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"6d21a4d2-3ef2-415a-a6cf-acfbd9cab36c"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"6d21a4d2-3ef2-415a-a6cf-acfbd9cab36c"}],"recentChangeFlags":null},{"id":"7aea3385-f658-410e-8e79-79bd4561748f","uri":"https://apps.apple.com/ca/app/lime-ridegreen/id1199780189","name":"Rider iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7615e9c8-5ab8-480f-b57f-6fe4910ca7e3","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"7aea3385-f658-410e-8e79-79bd4561748f"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"7aea3385-f658-410e-8e79-79bd4561748f"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"7aea3385-f658-410e-8e79-79bd4561748f"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"7aea3385-f658-410e-8e79-79bd4561748f"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"7aea3385-f658-410e-8e79-79bd4561748f"}],"recentChangeFlags":null},{"id":"3cea93e0-002b-4ac2-b1a9-2cad93a6b61f","uri":"https://play.google.com/store/apps/details?id=com.limebike","name":"Rider Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a5e92ebe-9904-4d87-b9cc-7e7d7a7d1d7b","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"3cea93e0-002b-4ac2-b1a9-2cad93a6b61f"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"3cea93e0-002b-4ac2-b1a9-2cad93a6b61f"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"3cea93e0-002b-4ac2-b1a9-2cad93a6b61f"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"3cea93e0-002b-4ac2-b1a9-2cad93a6b61f"}],"recentChangeFlags":null},{"id":"d7270eaa-1bd7-4bbb-814f-44c1211e3d51","uri":"https://play.google.com/store/apps/details?id=com.lime.supply\u0026hl=en_US","name":"Supply Android","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"da36618f-3cbf-4f39-ad98-79de45329f38","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"d7270eaa-1bd7-4bbb-814f-44c1211e3d51"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"d7270eaa-1bd7-4bbb-814f-44c1211e3d51"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"d7270eaa-1bd7-4bbb-814f-44c1211e3d51"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"d7270eaa-1bd7-4bbb-814f-44c1211e3d51"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"04659b76-e0f5-4606-a45f-7d2455779824","p1MaxCents":700000,"p1MinCents":550000,"p2MaxCents":350000,"p2MinCents":280000,"p3MaxCents":150000,"p3MinCents":80000,"p4MaxCents":45000,"p4MinCents":30000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eAll of the below targets are publicly accessible. Accounts can be provisioned where signup is available. Some of the targets will NOT have a user signup or registration process. This means it is for internal use only.  \u003c/p\u003e\n\n\u003ch1\u003eLime Mobile Apps\u003c/h1\u003e\n\n\u003cp\u003eOur mobile applications allow you to manage on the go. The apps are available on Android and iOS, they are a single codebase. Any issues found on backend logic in Android will also be on iOS, and vice versa. Submissions will be duplicated when submitting to either device.\u003c/p\u003e\n\n\u003ch2\u003eRider Application\u003c/h2\u003e\n\n\u003cp\u003eThis is our primary customer-facing mobile application which riders use to ride Lime products. The application allows riders to manage their account, start/reserve rides, manage their Lime subscriptions, create support requests, and other tasks. The Android app uses Kotlin and Java and the iOS app uses Swift and Objective-C, powered by ruby on rails on the backend, running on Kubernetes cluster in AWS. Credentials can be provisioned in the user signup flow in the application\u003c/p\u003e\n\n\u003ch2\u003eSupply Application (Supply One)\u003c/h2\u003e\n\n\u003cp\u003eThis is our primary operator-facing mobile application which operators use to perform operational tasks to keep the Lime fleet operational. The users of this application are Juicers and Logistical partners. The application allows operators to manage their account, perform out-of-warehouse tasks, manage their payment of how Lime pays them, provides a learning center of how to perform tasks, etc. The Android app uses Kotlin and Java and the iOS app uses Swift and Objective-C, powered by ruby on rails on the backend, running on the kubernetes cluster in AWS. Credentials can be provisioned in the user signup flow in the application. \u003c/p\u003e\n\n\u003ch1\u003eLime API testing\u003c/h1\u003e\n\n\u003ch2\u003eWeb-production API (lime.bike)\u003c/h2\u003e\n\n\u003cp\u003eThis API is our primary backend API. It is a RESTful API. This acts as the brain of all Lime applications. These APIs serve all the features of Lime applications described above. This is developed in Ruby on Rails.\u003c/p\u003e\n\n\u003ch2\u003eExternal API (lime.bike)\u003c/h2\u003e\n\n\u003cp\u003eThis API is our subset of backend APIs. It is a RESTful API. This endpoint serves Government relations requirements and Uber integration features. These APIs serves all the features of Admintool GR features and Uber app serving Lime riders. This is developed in Ruby on rails.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eexternal-api.lime.bike = Uber integration API\u003c/li\u003e\n\u003cli\u003eData.lime.bike = Government relations features API\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003eLime Bike communication\u003c/h1\u003e\n\n\u003ch2\u003eProxy platform\u003c/h2\u003e\n\n\u003cp\u003eThis is a centralized and unified IoT Message communication between bikes and backend workflow. It is an independent and isolated IoT parser service to consolidates different types and formats of device messages into same format\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eweb-message , web-message-high = Bike communication\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":5500,"max":7000},"2":{"min":2800,"max":3500},"3":{"min":800,"max":1500},"4":{"min":300,"max":450},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"716da0a6-ad87-47c0-bb6f-c0f308a82881","name":"Private In-Scope","targets":[{"id":"0d8ad4d8-6cf8-4ee3-9b55-1484e69d7672","uri":"","name":"admintool.lime.bike","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"52dc01ee-3f38-4b90-a33b-6c3991b32415","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"0d8ad4d8-6cf8-4ee3-9b55-1484e69d7672"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"0d8ad4d8-6cf8-4ee3-9b55-1484e69d7672"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"0d8ad4d8-6cf8-4ee3-9b55-1484e69d7672"}],"recentChangeFlags":null},{"id":"906df190-6399-4edb-a463-371ca001311d","uri":"","name":"juicer.lime.bike","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"34f55c17-d91c-4634-b96d-cd8387ef4446","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"906df190-6399-4edb-a463-371ca001311d"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"906df190-6399-4edb-a463-371ca001311d"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"906df190-6399-4edb-a463-371ca001311d"}],"recentChangeFlags":null},{"id":"12651991-d627-4e44-9d0b-05c5b5784e20","uri":"https://data.limeinternal.com","name":"Data portal","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e5ca2913-9e29-4770-980c-cc7a6b4b84bb","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"12651991-d627-4e44-9d0b-05c5b5784e20"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"12651991-d627-4e44-9d0b-05c5b5784e20"},{"id":"a634fd4f-7410-4f25-9d18-31f9ce752854","name":"CSS","targetId":"12651991-d627-4e44-9d0b-05c5b5784e20"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"12651991-d627-4e44-9d0b-05c5b5784e20"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"12651991-d627-4e44-9d0b-05c5b5784e20"},{"id":"ce8ff3cd-4d54-4404-8321-6351781551a3","name":"Vue.js","targetId":"12651991-d627-4e44-9d0b-05c5b5784e20"}],"recentChangeFlags":null},{"id":"abf0e86f-4aff-45e4-92cc-6bc6ed111b3f","uri":"","name":"help.lime.bike","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"437766bb-17d4-4125-85ae-9478625e6afc","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"abf0e86f-4aff-45e4-92cc-6bc6ed111b3f"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"abf0e86f-4aff-45e4-92cc-6bc6ed111b3f"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"abf0e86f-4aff-45e4-92cc-6bc6ed111b3f"}],"recentChangeFlags":null},{"id":"07ec053f-dfc1-404d-b90a-aaf678c30fcd","uri":"https://admintool.lime.bike","name":"Admintool","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8bf8b0fb-bf35-4541-95e8-6286637f089b","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"07ec053f-dfc1-404d-b90a-aaf678c30fcd"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"07ec053f-dfc1-404d-b90a-aaf678c30fcd"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"07ec053f-dfc1-404d-b90a-aaf678c30fcd"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"07ec053f-dfc1-404d-b90a-aaf678c30fcd"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"07ec053f-dfc1-404d-b90a-aaf678c30fcd"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"07ec053f-dfc1-404d-b90a-aaf678c30fcd"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"07ec053f-dfc1-404d-b90a-aaf678c30fcd"}],"recentChangeFlags":null},{"id":"11aa797c-3d9b-4c0d-bf02-3b7ddba8d12e","uri":null,"name":"ops.lime.bike","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9a7f0845-b4d5-4a13-a340-6f1affe6f41f","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"11aa797c-3d9b-4c0d-bf02-3b7ddba8d12e"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"11aa797c-3d9b-4c0d-bf02-3b7ddba8d12e"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"11aa797c-3d9b-4c0d-bf02-3b7ddba8d12e"}],"recentChangeFlags":null},{"id":"8004436f-4040-46f8-b2cb-02de7ab9c431","uri":"https://lp.lime.bike/","name":"LP dashboard","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fef6db4b-7e87-4d2f-9a49-0aac19e229ac","sortOrder":0},"sortOrder":0,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"8004436f-4040-46f8-b2cb-02de7ab9c431"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"8004436f-4040-46f8-b2cb-02de7ab9c431"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"8004436f-4040-46f8-b2cb-02de7ab9c431"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8004436f-4040-46f8-b2cb-02de7ab9c431"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"8004436f-4040-46f8-b2cb-02de7ab9c431"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"8004436f-4040-46f8-b2cb-02de7ab9c431"}],"recentChangeFlags":null},{"id":"4328fc26-529d-4cc5-bda7-cc2b3168901a","uri":"https://orchard.limeinternal.com","name":"Inhouse deployment pipeline","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f3ca980c-08cd-4f07-92d1-1a5405394613","sortOrder":0},"sortOrder":0,"tags":[{"id":"21e9186a-4f38-4a65-9ceb-62ee006bf3df","name":"Shell","targetId":"4328fc26-529d-4cc5-bda7-cc2b3168901a"},{"id":"40ac7f57-395c-4f6a-82fb-292f80ab0240","name":"HTML","targetId":"4328fc26-529d-4cc5-bda7-cc2b3168901a"},{"id":"a634fd4f-7410-4f25-9d18-31f9ce752854","name":"CSS","targetId":"4328fc26-529d-4cc5-bda7-cc2b3168901a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4328fc26-529d-4cc5-bda7-cc2b3168901a"},{"id":"f21f7de7-31b4-4cc8-89a4-39c9eb6b7345","name":"Python","targetId":"4328fc26-529d-4cc5-bda7-cc2b3168901a"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"4328fc26-529d-4cc5-bda7-cc2b3168901a"}],"recentChangeFlags":null},{"id":"3c35a6e4-b850-44b9-986b-bb9f860cf8d7","uri":"https://www.li.me/","name":"Lime website","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ff6fa471-a94c-4783-ae30-3f43437062ad","sortOrder":0},"sortOrder":0,"tags":[{"id":"40ac7f57-395c-4f6a-82fb-292f80ab0240","name":"HTML","targetId":"3c35a6e4-b850-44b9-986b-bb9f860cf8d7"},{"id":"a634fd4f-7410-4f25-9d18-31f9ce752854","name":"CSS","targetId":"3c35a6e4-b850-44b9-986b-bb9f860cf8d7"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3c35a6e4-b850-44b9-986b-bb9f860cf8d7"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"3c35a6e4-b850-44b9-986b-bb9f860cf8d7"}],"recentChangeFlags":null},{"id":"1111ed20-f984-4975-9724-29a1f87603c6","uri":"https://gpt.lime.bike","name":"Lime GPT","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f2570520-9701-4a24-9c85-a631b936439e","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1111ed20-f984-4975-9724-29a1f87603c6"},{"id":"d14cf1dd-8069-48ef-9a2b-779bf3a066f9","name":"Artificial Intelligence","targetId":"1111ed20-f984-4975-9724-29a1f87603c6"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"7d0af216-51d4-48f8-8493-b747b0f511e5","p1MaxCents":500000,"p1MinCents":400000,"p2MaxCents":280000,"p2MinCents":200000,"p3MaxCents":80000,"p3MinCents":50000,"p4MaxCents":30000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eAll of the below targets are not publicly accessible. Accounts can be provisioned where signup is available. Some of the targets will NOT have a user signup or registration process. This means it is for internal use only. \u003c/p\u003e\n\n\u003ch2\u003ePlease DO NOT email Lime to create test accounts for these endpoints.\u003c/h2\u003e\n\n\u003ch1\u003eLime Mobile Apps\u003c/h1\u003e\n\n\u003ch2\u003eOps application (iOS only)\u003c/h2\u003e\n\n\u003cp\u003eThis is our operators\u0026#39; mobile application which operators use to perform operational tasks to maintain the Lime fleet. The users of this application are Operators(FTE) and Lime full-time employees(FTE). The application allows operators to manage their accounts, perform in-warehouse tasks, manage their payment of how Lime pays them, provide a learning center of how to perform tasks, etc. This app is only available on Lime company-owned devices and Lime FTE devices. iOS app uses Swift and Objective-C, powered by ruby on rails on the backend, running on the kubernetes cluster in AWS. Credentials CANNOT be provisioned in the application. \u003c/p\u003e\n\n\u003ch1\u003eLime Web Apps\u003c/h1\u003e\n\n\u003ch2\u003eAdmintool Web application\u003c/h2\u003e\n\n\u003cp\u003eThis is our main management application which Lime employees use to configure settings of all three customer profiles. The users of this application are Lime full-time employees(FTE) and Government relations personnel of the Lime markets. The app uses Typescript and Javascript, powered by ruby on rails on the backend, running on Kubernetes cluster and served from an S3 bucket in AWS. Credentials CANNOT be provisioned at in the user signup flow of the application\u003c/p\u003e\n\n\u003ch2\u003eLP dashboard web-application\u003c/h2\u003e\n\n\u003cp\u003eThis is our management application which logistical partners use to onboard contractors to the Supply One app. The users of this application are Logistical Partner power users. The application allows LPs to manage their contractors, assign out-of-warehouse tasks to contractors, manage their payment, see Live maps of tasks, performance insights, and task forecasting. The app uses Typescript and Javascript, powered by ruby on rails on the backend, running on Kubernetes cluster and served from an S3 bucket in AWS. Credentials CANNOT be provisioned in the user signup flow of the application\u003c/p\u003e\n\n\u003ch2\u003eData Portal\u003c/h2\u003e\n\n\u003cp\u003eThis is our data portal application which Lime full-time employees use to view data insights to power their decision making. The users of this application are Lime full-time employees. The application allows Lime employees to share custom dashboards, insights, and queries to corroborate their decision-making. The app uses Vue, typescript, javascript, CSS, and shell scripts. Credentials CANNOT be provisioned in the user signup flow of the application.\u003c/p\u003e\n\n\u003ch2\u003eInhouse deployment pipeline\u003c/h2\u003e\n\n\u003cp\u003eThe users of this application are Lime full-time employees(developers). The application allows us to manage deployments, jobs, migrations, and sandboxes at Lime. The app uses Python, HTML, Javascript, CSS, and shell scripts. Credentials CANNOT be provisioned in the user signup flow of the application.\u003c/p\u003e\n\n\u003ch2\u003eLime website\u003c/h2\u003e\n\n\u003cp\u003eWebsite, though this is public but the main functionality resides on mobile applications. The users of this application are the general public. The application allows us to share information with the public. The app uses Twig, PHP, HTML, JavaScript, and CSS. Credentials CANNOT be provisioned in the user signup flow of the application.\u003c/p\u003e\n\n\u003ch2\u003eLime GPT\u003c/h2\u003e\n\n\u003cp\u003eThe users of this application are Lime full-time employees. The application allows us to use GPT-based AI methods for multiple applications including our internal knowledge chatbot, translations, feedback analysis, and photo verification. The app uses Python, streamlit, and OpenAI APIs. Credentials CANNOT be provisioned in the user signup flow of the application.\u003c/p\u003e\n\n\u003ch1\u003eLime API testing\u003c/h1\u003e\n\n\u003col\u003e\n\u003cli\u003eHelp.lime.bike: FAQ for Lime applications help center\u003c/li\u003e\n\u003cli\u003eops.lime.bike = Ops application\u003c/li\u003e\n\u003cli\u003ejuicer.lime.bike = LP dashboard\u003c/li\u003e\n\u003cli\u003eadmintool.lime.bike = Admintool application\u003c/li\u003e\n\u003c/ol\u003e","rewardRangeData":{"1":{"min":4000,"max":5000},"2":{"min":2000,"max":2800},"3":{"min":500,"max":800},"4":{"min":150,"max":300},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"454eac6a-95b3-406f-a338-0fc37e08200b","name":"Out-of-Scope","targets":[{"id":"f74936fc-a7bb-43c0-bdc1-9f3dfe2487b7","uri":"","name":"community.li.me (bevy)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6b81feec-987d-4612-8fe5-9872bf09e201","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"f74936fc-a7bb-43c0-bdc1-9f3dfe2487b7"}],"recentChangeFlags":null},{"id":"511a8b7b-46f7-49d3-af1e-b4b748ddda08","uri":"","name":"*.airflow.limeinternal.com (legacy domain)","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"051a03ee-7960-4e27-9fc9-167a21612a56","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"40908eaf-d671-4791-8837-d18cdd304379","uri":null,"name":"https://help.li.me (Zendesk)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0b042d72-ce86-4d26-bf77-704240186917","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"40908eaf-d671-4791-8837-d18cdd304379"}],"recentChangeFlags":null},{"id":"876be403-943c-41f0-925d-4484ccff3cbb","uri":null,"name":"*.limeinternal.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6fa1bd86-b817-47a4-9da0-66e38ce3d8ed","sortOrder":3},"sortOrder":3,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"876be403-943c-41f0-925d-4484ccff3cbb"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"876be403-943c-41f0-925d-4484ccff3cbb"}],"recentChangeFlags":null},{"id":"8dac8bfe-7eaf-447f-a6f0-94bb071a770b","uri":null,"name":"*.lime.bike","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a1750800-16e5-4af0-add5-5cf62dec936f","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"8dac8bfe-7eaf-447f-a6f0-94bb071a770b"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"8dac8bfe-7eaf-447f-a6f0-94bb071a770b"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"8dac8bfe-7eaf-447f-a6f0-94bb071a770b"}],"recentChangeFlags":null},{"id":"7d77a77f-d294-4858-ba9f-50d8f24955e8","uri":null,"name":"https://li.me (HubSpot)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d0338dd9-0fda-4011-bc48-3163d931633f","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7d77a77f-d294-4858-ba9f-50d8f24955e8"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eOut-of-Scope Targets (Wildcard Rule)\u003c/h2\u003e\n\n\u003cp\u003eAll wildcard (\u003ccode\u003e*\u003c/code\u003e) endpoint entries indicate that \u003cstrong\u003eany endpoint not explicitly listed as In-Scope is considered Out of Scope\u003c/strong\u003e.\u003c/p\u003e\n\n\u003cp\u003eFor example:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e*.lime.bike\u003c/code\u003e is listed as \u003cstrong\u003eOut of Scope\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eweb-production.lime.bike\u003c/code\u003e and \u003ccode\u003eadmintool.lime.bike\u003c/code\u003e are explicitly listed as \u003cstrong\u003eIn Scope\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIn this case:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eOnly\u003c/strong\u003e \u003ccode\u003eweb-production.lime.bike\u003c/code\u003e and \u003ccode\u003eadmintool.lime.bike\u003c/code\u003e are authorized for testing\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAll other\u003c/strong\u003e \u003ccode\u003elime.bike\u003c/code\u003e subdomains and endpoints are \u003cstrong\u003eOut of Scope\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIn general:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny endpoint \u003cstrong\u003eexplicitly listed as In Scope\u003c/strong\u003e is authorized for testing\u003c/li\u003e\n\u003cli\u003eAny endpoint \u003cstrong\u003enot explicitly listed as In Scope\u003c/strong\u003e should be treated as \u003cstrong\u003eOut of Scope\u003c/strong\u003e, even if it shares a common domain or parent wildcard\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIf you are unsure whether a specific endpoint is in scope, \u003cstrong\u003edo not test it\u003c/strong\u003e. Please contact Bugcrowd Support for clarification before proceeding.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"2d654155-0912-419f-b7c6-a860f538fa9d","code":"lime","state":"in_progress","endsAt":null,"bountyId":"13f8731f-c84a-4147-95f8-5eb973944be6","startsAt":"2019-09-10T17:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Transportation","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/3f16/f841/645f8de5/76f9fb42ebfced9a5f2e50915a78eaf7_Lime_Symbol_Green.png","logoBackgroundColor":"#000000","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2019-09-10T17:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/lime","changelogs":"/engagements/lime/changelog","submissions":null,"announcements":"/engagements/lime/announcements","hallOfFame":"/engagements/lime/hall_of_fames","crowdstream":"/engagements/lime/crowdstream"},"announcementsCount":11,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/lime/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=lime\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/lime/engagement_subscribers","engagementChangelogsUrl":"/engagements/lime/changelog","publishedAt":"2026-01-29T15:13:16.289Z","engagementChangelogUrl":"/engagements/lime/changelog/75a57d34-9894-4750-bc84-f6937a266609","createUserFeedbacksUrl":"/engagements/lime/feedbacks","engagementCrowdstreamUrl":"/engagements/lime/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}