{"id":"c2fdce1d-ed5f-4a57-b7f0-8f79417d5cd0","engagementId":"bd9bb612-53fb-4e95-8aed-bd14677173ee","data":{"brief":{"id":"8db94458-11f5-448a-981d-e961047333d3","name":"Linktree","tagline":"Linktree enables creators, brands, artists, publishers, agencies, and businesses of all sizes to curate a place where they can share, sell and grow. Please submit your findings to this Bug Bounty program.","description":"\u003cp\u003eWith 30 million global users, Linktree is helping brands, artists, publishers, agencies and influencers better control their presence online. The security of our platform is more important than ever, and we believe the global security community is a big part of that.\u003c/p\u003e\n\n\u003cp\u003eThe scope for Linktree's Bug Bounty program is inclusive of most of our assets. If you find something that would be impactful to our users, we want to hear about it.\u003c/p\u003e\n\n\u003cp\u003eYour participation in our Bug Bounty Program is voluntary. By submitting a report or otherwise disclosing a vulnerability to us, you are indicating that you have read and agree to follow the rules set forth on this page.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003eFor this program Linktree is leveraging CVSS for gauging impact and paying out rewards.** However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/p\u003e\n\n\u003cp\u003eThe translation between the CVSS Scores and bounties paid are outlined below:\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCVSS Scores\u003c/th\u003e\n\u003cth\u003eVRT Equivalent\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e10.0 - 9.0\u003c/td\u003e\n\u003ctd\u003eP1 / Critical\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e8.9 - 7.0\u003c/td\u003e\n\u003ctd\u003eP2 / High\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e6.9 - 4.0\u003c/td\u003e\n\u003ctd\u003eP3 / Medium\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e3.9 - 2.0\u003c/td\u003e\n\u003ctd\u003eP4 / Low\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e1.9 - 0.0\u003c/td\u003e\n\u003ctd\u003eP5 / Informational\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eAdditionally, the following modifications have been made:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAccess control bypass issues in link lock features pointing to public content are classified as Low severity.\u003c/li\u003e\n\u003cli\u003eDeleted assets/items that are still accessible are classified as Low severity.\u003c/li\u003e\n\u003cli\u003eCross-Site Scripting (XSS) attacks are considered at maximum a Medium severity.\u003c/li\u003e\n\u003cli\u003eSub-domain takeovers are considered at maximum a Medium severity.\u003c/li\u003e\n\u003cli\u003eDenial-of-Service (DoS) attacks via GraphQL (alias/directive overloading, batching, field duplication, circular/nested introspection, etc) are out of scope.  Please reference the Out of Scope Section.\u003c/li\u003e\n\u003c/ul\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Linktree not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Linktree, you can report it here. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eProgram Information:\u003c/h2\u003e\n\n\u003cp\u003ePlease provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not access, impact, destroy or otherwise negatively impact Linktree customers, or customer data in anyway.\u003c/li\u003e\n\u003cli\u003eMake a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder. Respect our users’ privacy.\u003c/li\u003e\n\u003cli\u003eNo extortion, shake downs, or duress.\u003c/li\u003e\n\u003cli\u003eDon’t leave any system in a more vulnerable state than you found it.\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eBe respectful when interacting on reports with our team.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eSubmit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eSubmitting multiple vulnerabilities across sub domains (dev/QA/staging/prod) is considered shared root cause and will be marked as duplicate. \u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWhen a vulnerability consists of different parameters but having the same api endpoint please group this together in the same report.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWhen a vulnerability is occurs to a third party integration (such as PayPal, etc) we will treat all reports as a single report\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWhen duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eMultiple vulnerabilities caused by one underlying issue will be awarded one bounty.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou are accountable for your testing traffic with reasonable and non disruptive testing to not cause production issues or exceed our rate limits of 10,000 requests per hour.\u003cbr\u003e\nIf your scenario is at risk of breaching the above, contact Bugcrowd for advice before proceeding.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess and credentials:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou can sign up for a free Linktree account with this link: \u003ca href=\"https://linktr.ee/register\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://linktr.ee/register\u003c/a\u003e. \u003c/li\u003e\n\u003cli\u003eYou can also sign up for a one month free trial of any plan (not including Premium) with your @bugcrowdninja.com email alias via this link: \u003ca href=\"https://linktr.ee/register?couponId=BUGBOUNTY30FREE\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://linktr.ee/register?couponId=BUGBOUNTY30FREE\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eFree accounts give you access to limited features while you will have more privileges with a Start, or Pro account. A list of accessible features is provided here: \u003ca href=\"https://linktr.ee/s/pricing/pricing-comparison/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://linktr.ee/s/pricing/pricing-comparison/\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eClickjacking on pages with no sensitive actions\u003c/li\u003e\n\u003cli\u003eTabnabbing on Android or iPhone app(s) on content not relating to sensitive actions or data\u003c/li\u003e\n\u003cli\u003eCross-Site Request Forgery (CSRF) on unauthenticated forms or forms with non-sensitive actions.\u003c/li\u003e\n\u003cli\u003eAttacks requiring MITM or physical access to a user's device.\u003c/li\u003e\n\u003cli\u003ePreviously known vulnerable libraries without a working Proof of Concept.\u003c/li\u003e\n\u003cli\u003eComma Separated Values (CSV) injection without demonstrating a vulnerability.\u003c/li\u003e\n\u003cli\u003eMissing best practices in SSL/TLS configuration.\u003c/li\u003e\n\u003cli\u003eContent spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.\u003c/li\u003e\n\u003cli\u003eRate limiting or brute-force issues on non-authentication endpoints.\u003c/li\u003e\n\u003cli\u003eRate limiting or DoS attacks on GraphQL endpoints.\u003c/li\u003e\n\u003cli\u003eMissing HttpOnly or Secure flags on cookies.\u003c/li\u003e\n\u003cli\u003eVulnerabilities only affecting users of outdated or unpatched browsers (Less than 2 stable versions behind the latest released stable version]).\u003c/li\u003e\n\u003cli\u003eSoftware version disclosure / banner identification issues / descriptive error messages or headers (e.g. stack traces, application or server errors).\u003c/li\u003e\n\u003cli\u003ePublic zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\u003c/li\u003e\n\u003cli\u003eTabnabbing\u003c/li\u003e\n\u003cli\u003eIssues that require unlikely user interaction\u003c/li\u003e\n\u003cli\u003eIssues related to identifying if someone is a free or pro user\u003c/li\u003e\n\u003cli\u003eAct's of self sabotage (such as making a linktree inaccessible) as owner or admin of Linktree account are out of scope\u003c/li\u003e\n\u003cli\u003eBypassing requirements for an elevation of account tier. For example: Upgrading tier without need of payment via API requests, using a discovered coupon code to upgrade tier, extending the free trial period, etc.\u003c/li\u003e\n\u003cli\u003eBypassing account tier requirements on individual features is out-of-scope (a list of tiers can be found at: https://linktr.ee/s/pricing/). This includes features that are exclusive for Pro or Premium users, or require an upgrade of tier. To clarify, bypassing account tier requirements on multiple features with the same method is in-scope.\u003c/li\u003e\n\u003cli\u003eBypassing account tier requirements on individual features for plannthat.com is out-of-scope.\u003c/li\u003e\n\u003cli\u003eFor the Plann product (Plann iOS app, Plann Android app, *.plannthat.com), spamming content is out of scope.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eResponse Targets\u003c/h2\u003e\n\n\u003cp\u003eBugcrowd have an initial triage time of P1 \u0026lt; 2 business days and P2-P5 \u0026lt;7 business days. Issues which have not been assigned a priority will be treated as P5 until Bugcrowd triage assigns one. \u003c/p\u003e\n\n\u003cp\u003eOnce triaged by Bugcrowd, Linktree will make a best effort to meet the following SLAs for researchers participating in our program:\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eLinktree Response\u003c/th\u003e\n\u003cth\u003eSLO in business days\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eFirst Response\u003c/td\u003e\n\u003ctd\u003e3 days\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eTime to Triage\u003c/td\u003e\n\u003ctd\u003e5 days\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eTime to Bounty\u003c/td\u003e\n\u003ctd\u003e14 days\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eTime to Resolution\u003c/td\u003e\n\u003ctd\u003eDepending on complexity and severity of issue\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eWe’ll keep you informed about our progress through each stage of response.\u003c/p\u003e\n\n\u003ch2\u003eDisclosure Policy\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease do not discuss any vulnerabilities (even resolved ones) outside of the program without consent from the Linktree team unless they are made public. We intend to make all reports public unless there is a compelling reason not to.\u003c/li\u003e\n\u003cli\u003eTo qualify for disclosure the report has to be in Resolved state, and raised by you.\u003c/li\u003e\n\u003cli\u003eDisclosed reports will be in limited state by default unless full disclosure is deemed necessary by Linktree\u003c/li\u003e\n\u003cli\u003eWe appreciate your help and promise to treat you as a friend and ally as long as you act in good faith.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"09e117cf-746e-4593-97f0-e3d84cdf98c8","name":"Primary Targets","targets":[{"id":"a8e7014b-0ca1-4caf-a05a-7c68a7c1f7de","uri":"https://linktr.ee","name":"*.linktr.ee","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5ace3153-ee5d-454c-9ade-90e9df909921","sortOrder":0},"sortOrder":0,"tags":[{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"a8e7014b-0ca1-4caf-a05a-7c68a7c1f7de"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a8e7014b-0ca1-4caf-a05a-7c68a7c1f7de"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"a8e7014b-0ca1-4caf-a05a-7c68a7c1f7de"},{"id":"e4e2931f-7be0-40ad-b88b-4e9cb9ffaf1e","name":"Amazon EC2","targetId":"a8e7014b-0ca1-4caf-a05a-7c68a7c1f7de"}],"recentChangeFlags":null},{"id":"d4f0a230-9bb1-43d0-82c1-1af8b5e20bda","uri":"https://linktree.com","name":"*.linktree.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3ab5783b-f932-495b-8cef-f9112d87e731","sortOrder":1},"sortOrder":1,"tags":[{"id":"21bf0b21-e645-4730-b030-be773c64efc7","name":"Gatsby","targetId":"d4f0a230-9bb1-43d0-82c1-1af8b5e20bda"},{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"d4f0a230-9bb1-43d0-82c1-1af8b5e20bda"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d4f0a230-9bb1-43d0-82c1-1af8b5e20bda"}],"recentChangeFlags":null},{"id":"43df6740-8c7f-4c0a-85ec-641cff6c511c","uri":"https://tr.ee","name":"*.tr.ee","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d9d1582c-9520-40e4-b44e-09b731aa6dfb","sortOrder":2},"sortOrder":2,"tags":[{"id":"21bf0b21-e645-4730-b030-be773c64efc7","name":"Gatsby","targetId":"43df6740-8c7f-4c0a-85ec-641cff6c511c"},{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"43df6740-8c7f-4c0a-85ec-641cff6c511c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"43df6740-8c7f-4c0a-85ec-641cff6c511c"}],"recentChangeFlags":null},{"id":"b063ee5b-29bf-4963-9b2c-155d170cc1b9","uri":"","name":"*.linktree-extensions.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"695e1a23-74bc-4640-8ca0-8cd414e6653f","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"a43ed2fe-130a-4410-b1fd-3beb4a0c20e6","uri":"https://linktree.app.link/LinktreeWebsite?utm_medium=Linktree_Footer","name":"Linktree iOS app","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"39195cf8-6139-41b0-acba-b8ebd3b1b76a","sortOrder":4},"sortOrder":4,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"a43ed2fe-130a-4410-b1fd-3beb4a0c20e6"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"a43ed2fe-130a-4410-b1fd-3beb4a0c20e6"}],"recentChangeFlags":null},{"id":"0fbb375d-25d9-4489-bc43-ae25ea8df50c","uri":"https://linktree.app.link/LinktreeWebsite?utm_medium=Linktree_Footer","name":"Linktree Android app","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e57e27f9-0358-4b02-be8b-e6962919010b","sortOrder":5},"sortOrder":5,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"0fbb375d-25d9-4489-bc43-ae25ea8df50c"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"0fbb375d-25d9-4489-bc43-ae25ea8df50c"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"d0483530-2270-40d2-8621-ef32bac759ee","p1MaxCents":750000,"p1MinCents":500000,"p2MaxCents":250000,"p2MinCents":100000,"p3MaxCents":60000,"p3MinCents":25000,"p4MaxCents":20000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":5000,"max":7500},"2":{"min":1000,"max":2500},"3":{"min":250,"max":600},"4":{"min":50,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"e057d512-c01c-4d8e-be52-4c8c6ddc3bf9","name":"Out of Scope Targets","targets":[{"id":"51c174f6-654f-4ee3-bc32-d1c23723d903","uri":"https://filestack.com","name":"*.filestack.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f603d5f4-9820-4f6f-9527-907758ebc758","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"3448b492-f010-463d-8207-ddcd7605e93c","uri":"https://freshdesk.com","name":"*.freshdesk.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"30714d1b-c1ca-493c-b361-fd92e5620a8e","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"f7a8ab12-bdf1-4b8a-8c0a-39becea12d33","uri":"https://blstr.xyz","name":"*.blstr.xyz","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8f9a084a-ae87-4f87-9e8b-3c5260c03200","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c1990324-5257-47d5-b6f8-dd0aa0504cb6","uri":"https://blstr.co","name":"*.blstr.co","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"24abd32f-5d9c-4b7d-89c2-698c5e887fef","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"11e6aa7d-bc15-495b-a4aa-afdf690b97a7","uri":"https://community.linktr.ee","name":"community.linktr.ee","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"89a2d2d8-ec4e-47f4-8245-a6602c816a2e","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"5b7bd805-20e5-4ebd-994c-84393d1364f6","name":"Secondary Targets","targets":[{"id":"b960906b-9259-4328-9996-632c78dca189","uri":"https://*.plannthat.com","name":"plannthat.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c1a9e639-0c77-43ff-8974-0de652a00223","sortOrder":0},"sortOrder":0,"tags":[{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"b960906b-9259-4328-9996-632c78dca189"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b960906b-9259-4328-9996-632c78dca189"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"b960906b-9259-4328-9996-632c78dca189"}],"recentChangeFlags":null},{"id":"507e0c3b-39c1-4661-9de6-bd8efe412c37","uri":"https://apps.apple.com/au/app/plann-preview-for-instagram/id1106201141","name":"Plann iOS app","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c4f173bb-ac74-456e-b2d3-e6b089d03487","sortOrder":1},"sortOrder":1,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"507e0c3b-39c1-4661-9de6-bd8efe412c37"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"507e0c3b-39c1-4661-9de6-bd8efe412c37"}],"recentChangeFlags":null},{"id":"016be61f-902d-46dc-a8c1-748ba04ab6a4","uri":"https://play.google.com/store/search?q=plann\u0026c=apps","name":"Plann Android app","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"432fdc3a-2efe-476b-96f6-2e837b4bde4c","sortOrder":2},"sortOrder":2,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"016be61f-902d-46dc-a8c1-748ba04ab6a4"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"016be61f-902d-46dc-a8c1-748ba04ab6a4"}],"recentChangeFlags":null},{"id":"be93bddb-5688-4f43-8cb5-044a6e77dcc5","uri":"https://odesli.co","name":"*.odesli.co","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"28c72697-664e-4e68-93d8-f4b927dfff47","sortOrder":3},"sortOrder":3,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"be93bddb-5688-4f43-8cb5-044a6e77dcc5"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"be93bddb-5688-4f43-8cb5-044a6e77dcc5"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"be93bddb-5688-4f43-8cb5-044a6e77dcc5"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"be93bddb-5688-4f43-8cb5-044a6e77dcc5"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"be93bddb-5688-4f43-8cb5-044a6e77dcc5"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"be93bddb-5688-4f43-8cb5-044a6e77dcc5"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"be93bddb-5688-4f43-8cb5-044a6e77dcc5"}],"recentChangeFlags":null},{"id":"fb825804-65cf-4339-840a-a94764bf0e6a","uri":"https://odesli.com","name":"*.odesli.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"34ca36be-5380-4b5b-8a42-f34e8e0cad29","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"3315c0bf-c7e5-4420-8e5a-5a2b53d708ea","uri":"https://song.link","name":"*.song.link","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"be146f33-09d7-461f-b839-f93a672adedb","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"f3fbcac0-15cd-4da3-a82e-addeacd599e1","uri":"https://songlink.io","name":"*.songlink.io","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a60fdba1-45e0-4a6b-8882-df69c9709e1f","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"22265457-a04f-4e82-91d3-77b394758b97","uri":"https://album.link","name":"*.album.link","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"635f3f00-ef60-4eb4-8fca-e2447d0f9e95","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null},{"id":"e3386fb6-e187-4b8c-88a0-7e511fe84c99","uri":"https://artist.link","name":"*.artist.link","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2b0c1701-19ef-4493-883b-942d4e9661f8","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null},{"id":"38469527-75d5-4826-940d-9ca3605cb0a3","uri":"https://pods.link","name":"*.pods.link","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6e6aaa82-6c97-4009-9dac-cfa0fcc5798c","sortOrder":9},"sortOrder":9,"tags":null,"recentChangeFlags":null},{"id":"4237b425-a230-49f7-aa2d-142b78b01938","uri":"https://playlist.link","name":"*.playlist.link","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a3328bb2-a932-4580-980b-78bd1b5a2e5c","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null},{"id":"ebca16c2-afb6-45f1-9059-5778562ef31d","uri":"https://mylink.page","name":"*.mylink.page","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"89f8436e-6983-48a4-9163-99d516ee36f0","sortOrder":11},"sortOrder":11,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":{"id":"150f303f-d22e-479d-8139-6646e06bd84a","p1MaxCents":200000,"p1MinCents":150000,"p2MaxCents":100000,"p2MinCents":80000,"p3MaxCents":20000,"p3MinCents":10000,"p4MaxCents":5000,"p4MinCents":2500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1500,"max":2000},"2":{"min":800,"max":1000},"3":{"min":100,"max":200},"4":{"min":25,"max":50},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"bd9bb612-53fb-4e95-8aed-bd14677173ee","code":"linktree-mbb-og","state":"in_progress","endsAt":null,"bountyId":"1cc0980c-bdbb-4177-89b6-d50eacd3cd31","startsAt":"2023-02-22T20:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/28fb/3ec2/b382f9fb/a7e48f373e89abe1b0c3491156c7af69_download.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2023-02-22T20:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/linktree-mbb-og","changelogs":"/engagements/linktree-mbb-og/changelog","submissions":null,"announcements":"/engagements/linktree-mbb-og/announcements","hallOfFame":"/engagements/linktree-mbb-og/hall_of_fames","crowdstream":null},"announcementsCount":14,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/linktree-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=linktree-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/linktree-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/linktree-mbb-og/changelog","publishedAt":"2025-09-22T23:17:40.600Z","engagementChangelogUrl":"/engagements/linktree-mbb-og/changelog/c2fdce1d-ed5f-4a57-b7f0-8f79417d5cd0","createUserFeedbacksUrl":"/engagements/linktree-mbb-og/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}