{"id":"dbc3059a-d453-413b-bf8c-6a0b4290bd75","engagementId":"9d67ef72-9852-4bc9-9c0c-d37c7a65c295","data":{"brief":{"id":"e99f0415-a635-49a5-81be-711a09bae5f0","name":"lululemon","tagline":"Breathe easy, it's on us.","description":"\u003cp\u003elululemon invites you to test and help secure our assets - We appreciate your efforts and hard work in making us more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eProgram Ground Rules\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eRespect our users' privacy.\u003c/li\u003e\n\u003cli\u003eDo not retain user data\u003c/li\u003e\n\u003cli\u003eDon't violate our Terms of Service or the law.\u003c/li\u003e\n\u003cli\u003eDon't impact our services.\u003c/li\u003e\n\u003cli\u003eParticipation Eligibility.\u003c/li\u003e\n\u003cli\u003eFollow Bugcrowd's rules.\u003c/li\u003e\n\u003cli\u003eDo not perform or attempt testing on items that are out scope\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003e\u003cstrong\u003eBugcrowd Program Updates - April 2026\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eBounty Structure\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eP1 (Critical):\u003c/strong\u003e $6,000 – $8,000\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eP2 (High):\u003c/strong\u003e $3,000 – $5,000\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eRewards are based on demonstrated impact, exploitability, and report quality.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eSeverity Acceptance Changes\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eReports rated \u003cstrong\u003eP3 (Medium) or below are no longer accepted\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eResearchers are encouraged to:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eChain vulnerabilities\u003c/strong\u003e where applicable\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDemonstrate higher-impact exploitation paths\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003eEscalate findings to meet \u003cstrong\u003eP2 or P1 severity criteria\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003eProvide other context or circumstances that would qualify as a qualifying severity\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eLow-impact, theoretical, or best-practice findings without meaningful security impact will be closed as out of scope.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eIn-Scope Assets\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWeb \u0026amp; Domains\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eshop.lululemon.com\u003c/li\u003e\n\u003cli\u003e*.lululemon.com\u003c/li\u003e\n\u003cli\u003ehttps://www.lululemon.com.au\u003c/li\u003e\n\u003cli\u003ehttps://www.lululemon.de\u003c/li\u003e\n\u003cli\u003ehttps://www.lululemon.es\u003c/li\u003e\n\u003cli\u003ehttps://www.eu.lululemon.com\u003c/li\u003e\n\u003cli\u003ehttps://www.lululemon.fr\u003c/li\u003e\n\u003cli\u003ehttps://www.lululemon.com.hk\u003c/li\u003e\n\u003cli\u003ehttp://www.lululemon.co.jp\u003c/li\u003e\n\u003cli\u003ehttp://www.lululemon.co.kr\u003c/li\u003e\n\u003cli\u003ehttps://www.lululemon.co.nz\u003c/li\u003e\n\u003cli\u003ehttps://www.lululemon.co.uk\u003c/li\u003e\n\u003cli\u003ehttps://www.mirror.co\u003c/li\u003e\n\u003cli\u003ehttps://www.lululemonstudio.com\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eMobile\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eLululemon Mobile App (iOS)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope Assets\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e*.lululemon.cn\u003c/li\u003e\n\u003cli\u003ehttps://fr.shop.lululemon.com\u003c/li\u003e\n\u003cli\u003e*.lululemon.me\u003c/li\u003e\n\u003cli\u003eGeneral website testing or non-security QA issues\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSpecial Rewards\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eRemote Unauthorized Access to Customer Databases or Datastores\u003c/strong\u003e\u003cbr\u003e\n\u003cstrong\u003eUp to $16,000\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eQualifying impact:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eRemote, unauthorized access to customer databases or datastores\u003c/li\u003e\n\u003cli\u003eAbility to read, modify, extract, or delete customer data (please do not destroy live data)\u003c/li\u003e\n\u003cli\u003eAccess obtained without valid credentials or intended administrative privileges\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eNotes:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eExploit must be externally reachable\u003c/li\u003e\n\u003cli\u003eInsider-only access, leaked internal credentials, or physical access scenarios do not qualify\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cstrong\u003eAccount Takeover (ATO) — No User Interaction Required\u003c/strong\u003e\u003cbr\u003e\n\u003cstrong\u003eUp to $16,000\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eA complete compromise of a customer account requiring \u003cstrong\u003ezero interaction\u003c/strong\u003e from the affected user.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eRequirements\u003c/strong\u003e:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eFull account takeover, including access to and modification of sensitive data (e.g., PII and/or PCI)\u003c/li\u003e\n\u003cli\u003eNo user interaction at any stage (e.g., no clicks, credential entry, email interaction, or device actions)\u003c/li\u003e\n\u003cli\u003eVulnerability must clearly demonstrate that the customer is not the initiating risk vector\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eCommon qualifying vulnerability classes include (but are not limited to)\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthentication or authorization bypass\u003c/li\u003e\n\u003cli\u003eSQL injection (SQLi)\u003c/li\u003e\n\u003cli\u003eArbitrary code execution\u003c/li\u003e\n\u003cli\u003eRemote code execution (RCE)\u003c/li\u003e\n\u003cli\u003eServer-side access control failures leading to account compromise\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cstrong\u003eAccount Takeover (ATO) — Single User Interaction\u003c/strong\u003e\u003cbr\u003e\n\u003cstrong\u003eUp to $13,000\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eA complete compromise of a customer account requiring \u003cstrong\u003eexactly one\u003c/strong\u003e intentional action by the user.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eOne user interaction only (e.g., single mouse click, keypress, or mobile tap)\u003c/li\u003e\n\u003cli\u003eInteraction must not involve credential entry or multi-step workflows\u003c/li\u003e\n\u003cli\u003eResults in full account takeover\u003c/li\u003e\n\u003cli\u003eRequires a full proof of concept, not just components that assume other vulnerabilities exist\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eExamples of qualifying interaction:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eClicking a single phishing or malicious URL\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eAdditional criteria:\u003c/strong\u003e\u003cbr\u003e\nAuthentication bypass occurs via existing customer-facing entry points (e.g., login, order tracking, returns, checkout)\u003cbr\u003e\nImpact includes ATO or access control failure affecting one or more of the following:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCheckout process\u003c/li\u003e\n\u003cli\u003eCustomer PII and/or PCI data\u003c/li\u003e\n\u003cli\u003eGift card balance or redemption\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eLimitations / exclusions:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePayloads or techniques cannot be reused to claim multiple high-tier rewards\u003c/li\u003e\n\u003cli\u003eIssues relying solely on weaknesses in third‑party or niche authentication providers may not qualify unless directly attributable to our implementation\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cstrong\u003eUnauthorized Access to Composite Customer PII / PCI Data\u003c/strong\u003e\u003cbr\u003e\n\u003cstrong\u003eNo User Interaction Required\u003cbr\u003e\nUp to $10,000\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eUnauthorized exposure of \u003cstrong\u003emultiple high-risk customer data elements\u003c/strong\u003e without any customer action.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eNo user interaction\u003c/li\u003e\n\u003cli\u003eVulnerability must be reproducible across multiple customer accounts\u003c/li\u003e\n\u003cli\u003eExposure of a single data element alone does not qualify (see below)\u003c/li\u003e\n\u003cli\u003eMust be repeatable for multiple users \u003c/li\u003e\n\u003cli\u003eMust be related to a vulnerability with Lululemon applications or infrastructure\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eQualifying data sets (one required):\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eFull name \u003cstrong\u003eand\u003c/strong\u003e shipping address (see limitations)\u003c/li\u003e\n\u003cli\u003eFull credit card details\u003c/li\u003e\n\u003cli\u003eLogin credentials (see limitations)\u003c/li\u003e\n\u003cli\u003eFull order history \u003cstrong\u003eand\u003c/strong\u003e shipping address\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eLimitations / exclusions:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eLululemon is not responsible for customer password practices across other sites, so credentials (or access due to credentials) from some unrelated data breach are out of scope\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cstrong\u003eAdditional Notes about the Program\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eSeverity and reward determination consider \u003cstrong\u003eimpact, exploitability, scope, and reproducibility\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003eClear proof-of-concept demonstrating real-world risk is required\u003c/li\u003e\n\u003cli\u003eChained vulnerabilities may qualify where the chain is clearly documented\u003c/li\u003e\n\u003cli\u003eDuplicate or previously reported issues may result in reduced or no reward\u003c/li\u003e\n\u003cli\u003eLululemon security team has discretion to accept or decline report without provide full context to research; our goal is engage in fair and respectful communications around our decisions\u003cbr\u003e\n\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":null,"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"7f47e5c3-6fda-40da-8246-182ddce395c6","name":"North America e-commerce sites","targets":[{"id":"f8ad1e50-c320-4f38-9d48-14db81ae5d2e","uri":"https://shop.lululemon.com","name":"shop.lululemon.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"483d19e2-1cdb-4522-8d60-e5be8afafca5","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"f8ad1e50-c320-4f38-9d48-14db81ae5d2e"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"f8ad1e50-c320-4f38-9d48-14db81ae5d2e"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"f8ad1e50-c320-4f38-9d48-14db81ae5d2e"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"f8ad1e50-c320-4f38-9d48-14db81ae5d2e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f8ad1e50-c320-4f38-9d48-14db81ae5d2e"},{"id":"d2e9f7fd-1403-4a01-b5b8-fba5e0f49e37","name":"ExpressJS","targetId":"f8ad1e50-c320-4f38-9d48-14db81ae5d2e"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"f8ad1e50-c320-4f38-9d48-14db81ae5d2e"}],"recentChangeFlags":null},{"id":"50fd3c7f-e969-4a7d-a223-690e6ed7347f","uri":null,"name":"*.lululemon.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"12c3116f-0260-4c71-a471-99d52144ae99","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"50fd3c7f-e969-4a7d-a223-690e6ed7347f"}],"recentChangeFlags":null},{"id":"0537f565-79ab-44d4-aecf-23cefe282178","uri":"https://apps.apple.com/us/app/lululemon/id920098546","name":"Lululemon Mobile App - iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0cbfee6f-cace-4e87-8b37-719a872385b1","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"0537f565-79ab-44d4-aecf-23cefe282178"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"0537f565-79ab-44d4-aecf-23cefe282178"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"0537f565-79ab-44d4-aecf-23cefe282178"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"bb220e19-20a4-48a1-9676-cff5fc2cce1f","p1MaxCents":800000,"p1MinCents":600000,"p2MaxCents":500000,"p2MinCents":300000,"p3MaxCents":null,"p3MinCents":null,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":1000000},"descriptionHtml":null,"rewardRangeData":{"1":{"min":6000,"max":8000},"2":{"min":3000,"max":5000},"3":{"min":null,"max":null},"4":{"min":null,"max":null},"5":{"min":null,"max":null},"programMax":10000},"recentChangeFlags":null},{"id":"a44e44d4-3a6a-4fd0-9ef4-8d89e246a8af","name":"International e-commerce sites","targets":[{"id":"7c67ef5e-0fdf-4ce3-ad17-cfac753cda38","uri":"https://www.lululemon.com.au/  ","name":"https://www.lululemon.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a8b4b89e-7a71-4ad0-a7f9-1ee6e7416319","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"7c67ef5e-0fdf-4ce3-ad17-cfac753cda38"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7c67ef5e-0fdf-4ce3-ad17-cfac753cda38"}],"recentChangeFlags":null},{"id":"3ec05e14-37c9-42d7-bb66-d3b2bf97b9a7","uri":"https://www.lululemon.de/","name":"https://www.lululemon.de","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"365dde40-4c62-4bbe-895b-1b3a86d48ee8","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"3ec05e14-37c9-42d7-bb66-d3b2bf97b9a7"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3ec05e14-37c9-42d7-bb66-d3b2bf97b9a7"}],"recentChangeFlags":null},{"id":"af4da5b0-6151-41d0-b7bb-3e80f847e6d1","uri":"https://www.lululemon.es/ ","name":"https://www.lululemon.es","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"be64ba74-3e10-4391-90fc-b0d2493e9169","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"af4da5b0-6151-41d0-b7bb-3e80f847e6d1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"af4da5b0-6151-41d0-b7bb-3e80f847e6d1"}],"recentChangeFlags":null},{"id":"0d896e84-215c-4878-a2bb-9b5a286696cc","uri":"https://www.eu.lululemon.com/","name":"https://www.eu.lululemon.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bd27dd58-a26b-4763-a15e-3984734c1095","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"0d896e84-215c-4878-a2bb-9b5a286696cc"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0d896e84-215c-4878-a2bb-9b5a286696cc"}],"recentChangeFlags":null},{"id":"5873dae9-afb1-4118-8881-f823bee45be8","uri":"https://www.lululemon.fr/","name":"https://www.lululemon.fr","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"362ec950-0b47-4cd4-ac21-a82aa672dc2b","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"5873dae9-afb1-4118-8881-f823bee45be8"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5873dae9-afb1-4118-8881-f823bee45be8"}],"recentChangeFlags":null},{"id":"ab199ace-3339-490d-81e5-162bfec97bc6","uri":"https://www.lululemon.com.hk/","name":"https://www.lululemon.com.hk","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c006816e-2395-4008-bf40-3d3d4b61d7d6","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"ab199ace-3339-490d-81e5-162bfec97bc6"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ab199ace-3339-490d-81e5-162bfec97bc6"}],"recentChangeFlags":null},{"id":"1d6ba094-f12b-4c62-9551-62a047229696","uri":"https://www.lululemon.co.jp/","name":"http://www.lululemon.co.jp","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b76a90d1-4adc-43e5-a761-e8f79cab905e","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"1d6ba094-f12b-4c62-9551-62a047229696"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1d6ba094-f12b-4c62-9551-62a047229696"}],"recentChangeFlags":null},{"id":"98734207-2213-4876-9bb2-3dc21229e0f2","uri":"http://www.lululemon.co.kr/","name":"http://www.lululemon.co.kr","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"86418415-a992-452c-ac25-de722ce30589","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"98734207-2213-4876-9bb2-3dc21229e0f2"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"98734207-2213-4876-9bb2-3dc21229e0f2"}],"recentChangeFlags":null},{"id":"b81cece4-0ab4-44c9-ac74-ed30a71a7d1e","uri":"https://www.lululemon.co.nz/","name":"https://www.lululemon.co.nz","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cd47b442-f48d-4f5b-a113-1b26d38df18d","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"b81cece4-0ab4-44c9-ac74-ed30a71a7d1e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b81cece4-0ab4-44c9-ac74-ed30a71a7d1e"}],"recentChangeFlags":null},{"id":"dadd3114-24c1-4951-809b-91b322b317f8","uri":"https://www.lululemon.co.uk/","name":"https://www.lululemon.co.uk","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"669fcaf1-94e0-4a78-bef2-aba5ef39c711","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"dadd3114-24c1-4951-809b-91b322b317f8"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"dadd3114-24c1-4951-809b-91b322b317f8"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"bb24db82-373d-4dec-851a-53913d0e7be3","p1MaxCents":800000,"p1MinCents":600000,"p2MaxCents":500000,"p2MinCents":300000,"p3MaxCents":null,"p3MinCents":null,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eSome websites in these countries/regions are subject to enhanced legal and regulatory obligations for protecting personal information. lululemon expects strict compliance with Bugcrowd terms and conditions relating to PII when testing these sites.\u003c/p\u003e\n\n\u003cp\u003eAcknowledging that these 10 sites come from a common code base, when a researcher reports a flaw, it is assumed that the flaw may apply to all 10 sites. A discovered flaw for one of these sites will be considered as a duplicate when reported for one of the other websites within the International e-Commerce group.\u003c/p\u003e","rewardRangeData":{"1":{"min":6000,"max":8000},"2":{"min":3000,"max":5000},"3":{"min":null,"max":null},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"6c9af7f1-f394-4bd4-9933-17f72eaa248f","name":"Out of Scope","targets":[{"id":"f4f7d74a-e065-4c5c-bd8b-3562ea68042f","uri":"","name":"*.lululemon.cn","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"52022244-7ec9-4ecc-adb7-b26ca2d87c48","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f4f7d74a-e065-4c5c-bd8b-3562ea68042f"}],"recentChangeFlags":null},{"id":"58c831b3-bf77-4daa-b7d1-c154882f8db9","uri":"https://fr.shop.lululemon.com","name":"https://fr.shop.lululemon.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c9939c14-eab7-4925-a7b1-fad51b14ec40","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"58c831b3-bf77-4daa-b7d1-c154882f8db9"}],"recentChangeFlags":null},{"id":"ae2121e8-59dc-45a9-a442-5a98eb4b92cb","uri":"https://www.lululemon.me","name":"*.lululemon.me","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"23a4b2c6-3171-4482-86ed-014900c4d616","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ae2121e8-59dc-45a9-a442-5a98eb4b92cb"}],"recentChangeFlags":null},{"id":"91296c67-d561-43b0-aca2-1d50aa7fef11","uri":"https://careers.lululemon.com/","name":"careers.lululemon.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ac31a80e-052e-4b47-9da9-03f623829d8d","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"91296c67-d561-43b0-aca2-1d50aa7fef11"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"31cba70f-9c95-48bd-a71f-21b6412c7e8f","name":"AEM Systems","targets":[{"id":"f0f1e433-20b3-425b-ac5a-2dc8c714be3e","uri":"https://info.lululemon.com","name":"https://info.lululemon.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"682524fd-2fcc-4f6e-848b-7ec0cc9b5edb","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7a86f806-4b40-4026-943c-16d742220655","uri":"https://pnimage.lululemon.com","name":"https://pnimages.lululemon.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5f1a1528-6304-42e8-9476-aace885f9cfc","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"f2b8c9c7-f157-42c0-9944-0df72761a00f","uri":"","name":"AEM - Assets","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5e8fd49b-9067-48bf-8264-9dd73333e19e","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c6fac8f7-028c-413c-ae9a-5d00d7cad1d0","uri":"","name":"AEM - Sites","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a5650d81-f80a-410e-b7a6-3d235475cf58","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":3,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eExploits with severity: P3-P5\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"36171eac-038e-4c29-a7cb-3315ab1fe29f","name":"lululemon Studio","targets":[{"id":"de5fc201-c210-4fdc-aad8-98415f7b48c8","uri":"https://www.mirror.co/","name":"https://www.mirror.co","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ad4bd11e-cbac-4243-987f-387ac3ed5ae3","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":4,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eExploits with severity: P3-P5\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[{"id":"c473aca1-728f-4ffc-8bbd-ef37ef40d889","attachmentPath":"https://bugcrowd.com/engagements/lululemon/attachments/c473aca1-728f-4ffc-8bbd-ef37ef40d889","name":"image-2023-07-13T21:11:16.523Z.png","filename":"image-2023-07-13T21:11:16.523Z.png","description":null,"icon":"fileImage","size":16297,"sizeLabel":"15.9 KB","uploadedAt":"3 Sep 2024","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/lululemon/attachments/c473aca1-728f-4ffc-8bbd-ef37ef40d889"}],"engagement":{"id":"9d67ef72-9852-4bc9-9c0c-d37c7a65c295","code":"lululemon","state":"in_progress","endsAt":null,"bountyId":"4095b9be-93a7-4676-8427-78a6e2b92285","startsAt":"2019-06-04T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/3f29/7ac8/759f87e1/a450fe08e29d237aac331bf826616d00_76ce0a719daca3d211f0158d547c4bbb_VXqnFv33_400x400.jpg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2026-09-21T18:30:25.539Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/lululemon","changelogs":"/engagements/lululemon/changelog","submissions":null,"announcements":"/engagements/lululemon/announcements","hallOfFame":"/engagements/lululemon/hall_of_fames","crowdstream":"/engagements/lululemon/crowdstream"},"announcementsCount":18,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/lululemon/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=lululemon\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/lululemon/engagement_subscribers","engagementChangelogsUrl":"/engagements/lululemon/changelog","publishedAt":"2026-09-22T21:12:08.291Z","engagementChangelogUrl":"/engagements/lululemon/changelog/dbc3059a-d453-413b-bf8c-6a0b4290bd75","createUserFeedbacksUrl":"/engagements/lululemon/feedbacks","engagementCrowdstreamUrl":"/engagements/lululemon/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}