{"id":"75bc83aa-24dc-4496-aaa2-9fc9abcbbb37","engagementId":"33bd362b-6997-43db-8cdb-bdde68eef5d8","data":{"brief":{"id":"6453f5a5-065a-47c9-aaf9-46db23c3b818","name":"Luno Bug Bounty Program","tagline":"Luno Bug Bounty Program","description":"\u003cp\u003eLuno aims to be the safest and most compliant crypto investment platform in the world. We take a regulation-first approach and have some of the most intensive security processes in crypto, according to \u003ca href=\"https://ccdata.io/research/exchange-benchmark-rankings\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCCData\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eWe take security seriously and look forward to collaborating with the crowdsource security community.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eFor an additional \u003cstrong\u003e5% bonus\u003c/strong\u003e please see \u003ca href=\"#accesstraffic-identification\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eadd the HTTP request headers\u003c/a\u003e.\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Luno not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Luno, you can report it to here. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthentication \u0026amp; Authorization\u003c/li\u003e\n\u003cli\u003eSession management\u003c/li\u003e\n\u003cli\u003eIndirect Object Referencing\u003c/li\u003e\n\u003cli\u003eMisconfigurations\u003c/li\u003e\n\u003cli\u003eRemote Code Execution\u003c/li\u003e\n\u003cli\u003eExposed Buckets/Sensitive Resources\u003c/li\u003e\n\u003cli\u003eEndpoints that are not behind CloudFlare\u003c/li\u003e\n\u003cli\u003eLeaked sensitive information such as intellectual property, e.g. Source code committed to public repositories such as GitLab or GitHub\u003c/li\u003e\n\u003cli\u003eBusiness logic-related vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eTarget Information\u003c/h2\u003e\n\n\u003ch3\u003eInfrastructure\u003c/h3\u003e\n\n\u003cp\u003eLuno’s website portals are either managed internally as Angular projects or contracted out to other parties. The Angular projects are kept on the latest or second latest version.\u003c/p\u003e\n\n\u003cp\u003eLuno primarily uses AWS, Cloudflare and Nginx.\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eProvider\u003c/th\u003e\n\u003cth\u003eProducts\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eAWS\u003c/td\u003e\n\u003ctd\u003eEC2, EKS, RDS, Elasticache, S3, Route 53, Cloudfront\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eCloudflare\u003c/td\u003e\n\u003ctd\u003eFirewall, DNS\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ch2\u003eApplication\u003c/h2\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003e\u003c/th\u003e\n\u003cth\u003ePlatform\u003c/th\u003e\n\u003cth\u003eFrameworks \u0026amp; Languages\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eFrontend\u003c/td\u003e\n\u003ctd\u003eWeb\u003c/td\u003e\n\u003ctd\u003eAJAX, Angular JS\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eFrontend\u003c/td\u003e\n\u003ctd\u003eiOS\u003c/td\u003e\n\u003ctd\u003eKotlin, Swift UI\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eFrontend\u003c/td\u003e\n\u003ctd\u003eAndroid\u003c/td\u003e\n\u003ctd\u003eKotlin, Java\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBackend\u003c/td\u003e\n\u003ctd\u003eKubernetes\u003c/td\u003e\n\u003ctd\u003eGo, gRPC, API\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ch3\u003eAPI\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://www.luno.com/en/developers/api#tag/Changelog\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAPI Changelog\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\n\u003ca href=\"https://www.luno.com/en/developers/api\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAPI Documentation\u003c/a\u003e \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eMobile Apps\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eiOS application is written in Swift. Basic authentication, 2FA, Passkeys and HMAC authentication are all utilised.\u003c/li\u003e\n\u003cli\u003eAndroid application is primarily written in Kotlin. Certificate pinning, basic authentication, 2FA, Passkeys and HMAC authentication are all utilised.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eCredentials\u003c/h3\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address here: \u003ca href=\"https://staging.luno.com/en/signup\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://staging.luno.com/en/signup\u003c/a\u003e\u003c/p\u003e\n\n\u003cp\u003eFor more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch3\u003eTraffic Identification\u003c/h3\u003e\n\n\u003cp\u003eA \u003cstrong\u003e5% bonus\u003c/strong\u003e will be added to eligible submissions which include the following headers:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eRequired: \u003ccode\u003ex-luno-bugcrowd-id: {Bugcrowd username}\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003eOptional (specific announcement): \u003ccode\u003ex-luno-announcement-id: {optional - use when testing a specific announcement}\u003c/code\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003ePlease note: header names must all be in lowercase as shown above.\u003c/p\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eP5 vulnerabilities\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvailability/volumetric testing e.g.:\n\n\u003cul\u003e\n\u003cli\u003eDoS/DDoS/Network DoS\u003c/li\u003e\n\u003cli\u003eRate limiting bypass attempts\u003c/li\u003e\n\u003cli\u003eEmail bombing flooding\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eMobile vulnerabilities which require a malicious application to be installed, unsupported OS, or user interaction.\u003c/li\u003e\n\u003cli\u003eSubmissions which do not impact confidentiality, integrity or availability of the application or user\u003c/li\u003e\n\u003cli\u003eBest practice/automated tool output.\u003c/li\u003e\n\u003cli\u003eFirebase vulnerabilities with Debug Flags or Empty Database Instances\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eN-day/Third party 0-day Policy\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eWhen N-Day bugs are released to the public, we will consider these as in scope after 14 days has gone by\n\n\u003cul\u003e\n\u003cli\u003ee.g: N-day released on 01/01/2025, we would consider it in-scope on 01/15/2025\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eInteracting or manipulate other stakeholders and their associated accounts including:\n\n\u003cul\u003e\n\u003cli\u003eSocial engineering attacks\u003c/li\u003e\n\u003cli\u003ePhishing attacks\u003c/li\u003e\n\u003cli\u003ePhysical attacks\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eThird party providers and services\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePotential post-exploitation scenarios\u003c/strong\u003e: If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding. We will work with you to evaluate the vulnerability and award you accordingly for the final impact and severity.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eLeaked Credentials\u003c/h2\u003e\n\n\u003cp\u003eIf you happen to identify vulnerabilities involving data that has been exposed or leaked such as dark web forums or leaked credential sites. You can report it to this engagement. However, be aware that it is only eligible for points-based compensation. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance.\u003c/p\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"ae9cdba2-9bd3-4194-a0d3-11c459bdb652","name":"Mobile targets","targets":[{"id":"114db956-3aba-417a-9a20-832a4ef37db8","uri":"https://play.google.com/store/apps/details?hl=en\u0026id=co.bitx.android.wallet","name":"Luno Android Application","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"75695b60-3fd0-400a-98dc-3c4547530d18","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"114db956-3aba-417a-9a20-832a4ef37db8"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"114db956-3aba-417a-9a20-832a4ef37db8"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"114db956-3aba-417a-9a20-832a4ef37db8"}],"recentChangeFlags":null},{"id":"6d1476f1-9d2f-4f8b-9190-615428fbbf50","uri":"https://apps.apple.com/app/bitx-wallet/id927362479","name":"Luno iOS Application","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"06f8c28a-6ae4-4a38-b601-f343b28cd59d","sortOrder":1},"sortOrder":1,"tags":[{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"6d1476f1-9d2f-4f8b-9190-615428fbbf50"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"6d1476f1-9d2f-4f8b-9190-615428fbbf50"}],"recentChangeFlags":null},{"id":"7e455580-ffb9-4971-9535-2df758df498a","uri":"https://mobileapi.staging.luno.com/","name":"https://mobileapi.staging.luno.com/","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d170cf45-27f7-4131-8165-aa552cff15c1","sortOrder":2},"sortOrder":2,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"7e455580-ffb9-4971-9535-2df758df498a"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"7e455580-ffb9-4971-9535-2df758df498a"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"969e5b3a-1e11-46bf-86fc-070de725f578","p1MaxCents":750000,"p1MinCents":450000,"p2MaxCents":300000,"p2MinCents":225000,"p3MaxCents":100000,"p3MinCents":82500,"p4MaxCents":37500,"p4MinCents":22500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eStaging mobile apps are not currently available. Mobile apps are in production. Integrity and stability testing are out of scope. Please see the \u003ca href=\"#out-of-scope-1\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eout of scope\u003c/a\u003e and \u003ca href=\"#excluded-submission-types\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eexcluded submission types\u003c/a\u003e section for further details.\u003c/p\u003e","rewardRangeData":{"1":{"min":4500,"max":7500},"2":{"min":2250,"max":3000},"3":{"min":825,"max":1000},"4":{"min":225,"max":375},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"9a22a4c7-95ea-4a6e-9ae9-48a1f59c35c0","name":"Web targets","targets":[{"id":"148ddd37-91ed-4f28-9331-0fc6c651191a","uri":"https://staging.luno.com/","name":"*.staging.luno.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9cd0c262-bbbd-4d84-84cc-7d310ff8c22e","sortOrder":1},"sortOrder":1,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"148ddd37-91ed-4f28-9331-0fc6c651191a"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"148ddd37-91ed-4f28-9331-0fc6c651191a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"148ddd37-91ed-4f28-9331-0fc6c651191a"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"148ddd37-91ed-4f28-9331-0fc6c651191a"}],"recentChangeFlags":null},{"id":"00606062-731d-416f-9db9-6d8afcfbbda9","uri":"https://staging.luno.com.ng","name":"*staging.luno.com.ng/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"906ccff2-318c-4b76-bc95-3e0e70f1f5a7","sortOrder":2},"sortOrder":2,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"00606062-731d-416f-9db9-6d8afcfbbda9"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"00606062-731d-416f-9db9-6d8afcfbbda9"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"00606062-731d-416f-9db9-6d8afcfbbda9"}],"recentChangeFlags":null},{"id":"c2cc5d70-30d0-4310-b43d-37c39c4c3476","uri":"https://api.staging.luno.com/","name":"https://api.staging.luno.com/","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ad64d123-2ed7-4ff7-9ce0-f92a198e039f","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c2cc5d70-30d0-4310-b43d-37c39c4c3476"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"c2cc5d70-30d0-4310-b43d-37c39c4c3476"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"c2cc5d70-30d0-4310-b43d-37c39c4c3476"}],"recentChangeFlags":null},{"id":"4733bd4f-967c-4f7b-bd99-5516f2bfcbb2","uri":"https://app.staging.luno.com/","name":"https://app.staging.luno.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0c5ddc11-c56e-4252-8140-d67364c968b6","sortOrder":5},"sortOrder":5,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"4733bd4f-967c-4f7b-bd99-5516f2bfcbb2"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"4733bd4f-967c-4f7b-bd99-5516f2bfcbb2"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4733bd4f-967c-4f7b-bd99-5516f2bfcbb2"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"4733bd4f-967c-4f7b-bd99-5516f2bfcbb2"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"5558075b-ba1d-4b70-a0cb-efca294c379a","p1MaxCents":300000,"p1MinCents":250000,"p2MaxCents":180000,"p2MinCents":150000,"p3MaxCents":65000,"p3MinCents":50000,"p4MaxCents":20000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003ePlease ensure to prefix the endpoints to \u003ccode\u003ehttps://staging.luno.com\u003c/code\u003e when testing. The OpenAPI specification is available for download from our documentation. You can import this into your tool of choice i.e. Postman.\u003c/p\u003e\n\n\u003cp\u003e\u003ca href=\"https://www.luno.com/en/developers/api\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOpenAPI Specification Download\u003c/a\u003e.\u003c/p\u003e","rewardRangeData":{"1":{"min":2500,"max":3000},"2":{"min":1500,"max":1800},"3":{"min":500,"max":650},"4":{"min":100,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[{"id":"74773d85-9471-4707-9707-72f0f2e3d8f8","attachmentPath":"https://bugcrowd.com/engagements/luno-og/attachments/74773d85-9471-4707-9707-72f0f2e3d8f8","name":"data-share.png","filename":"data-share.png","description":null,"icon":"fileImage","size":45971,"sizeLabel":"44.9 KB","uploadedAt":"14 Jan 2025","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/luno-og/attachments/74773d85-9471-4707-9707-72f0f2e3d8f8"},{"id":"90c62c47-3dc2-41b4-8f50-9b01a42c4bc7","attachmentPath":"https://bugcrowd.com/engagements/luno-og/attachments/90c62c47-3dc2-41b4-8f50-9b01a42c4bc7","name":"share_account.png","filename":"share_account.png","description":null,"icon":"fileImage","size":46679,"sizeLabel":"45.6 KB","uploadedAt":"14 Jan 2025","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/luno-og/attachments/90c62c47-3dc2-41b4-8f50-9b01a42c4bc7"}],"engagement":{"id":"33bd362b-6997-43db-8cdb-bdde68eef5d8","code":"luno-og","state":"in_progress","endsAt":null,"bountyId":"cf8a3b30-81f1-47a0-a951-d574c8595fbd","startsAt":"2020-11-04T19:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/90ca/b8c8/a0b610b1/957423f1634a108b88ec40b5d8b52e11_lunoicon-152x152.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-11-04T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/luno-og","changelogs":"/engagements/luno-og/changelog","submissions":null,"announcements":"/engagements/luno-og/announcements","hallOfFame":"/engagements/luno-og/hall_of_fames","crowdstream":"/engagements/luno-og/crowdstream"},"announcementsCount":50,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/luno-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=luno-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/luno-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/luno-og/changelog","publishedAt":"2026-05-27T11:04:11.684Z","engagementChangelogUrl":"/engagements/luno-og/changelog/75bc83aa-24dc-4496-aaa2-9fc9abcbbb37","createUserFeedbacksUrl":"/engagements/luno-og/feedbacks","engagementCrowdstreamUrl":"/engagements/luno-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}