{"id":"17e7a8a3-0049-417f-956e-6f7ae42679d0","engagementId":"fd141ccb-2630-458e-aa38-c902e7579ff1","data":{"brief":{"id":"3e6739a8-2c92-49fd-a617-6c4b21da528b","name":"Majid Al Futtaim Lifestyle","tagline":"Majid Al Futtaim Lifestyle","description":"\u003cp\u003eMajid Al Futtaim Fashion invites you to test and help secure our primary publicly facing assets - focusing on our web and mobile applications. We appreciate your efforts and hard work in making the internet more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eValid P4 reports will be upgraded to P3 and paid at the following range:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e$300 - $500\u003c/li\u003e\n\u003c/ul\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as In-Scope. \u003cem\u003eAny domain/property of Majid Al Futaim Fashion  not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e \u003c/p\u003e\n\n\u003cp\u003eIf you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Majid Al Futaim Fashion, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation.*\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003ePlease feel free to provision your own account(s) using your @bugcrowdninja.com e-mail address. More information on the Bugcrowd Ninja e-mail address can be found here: \u003ca href=\"https://researcherdocs.bugcrowd.com/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://researcherdocs.bugcrowd.com/docs/your-bugcrowdninja-email-address\u003c/a\u003e\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eVulnerabilities\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAbility to remotely gain access to other user's PCI details credit cards, CVV, etc)\u003c/li\u003e\n\u003cli\u003eAbility to remotely gain access to other user's personal details (first name, last name, contact details, passwords, etc)\u003c/li\u003e\n\u003cli\u003eExfiltration of personal data or credit card data\u003c/li\u003e\n\u003cli\u003eRemote unauthorized access to MAF Fashion database\u003c/li\u003e\n\u003cli\u003eAbuse of vouchers, loyalty points, and promo codes\u003c/li\u003e\n\u003cli\u003eRemote code execution\u003c/li\u003e\n\u003cli\u003eDefacement\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eCritical targets:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eProd API URL: \u003ca href=\"https://api-prod.thatconceptstore.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://api-prod.thatconceptstore.com/\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eProduction IOS APP Store Address: \u003ca href=\"https://apps.apple.com/app/id1503045795\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://apps.apple.com/app/id1503045795\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eProduction Android APP Store Address: \u003ca href=\"https://play.google.com/store/apps/details?id=com.maf.thatandroid\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://play.google.com/store/apps/details?id=com.maf.thatandroid\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eThe following is not allowed:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eModifying data residing in an account that does not belong to you\u003c/li\u003e\n\u003cli\u003eAccessing or downloading data beyond the minimum required to demonstrate a vulnerability. This should not exceed 1-2 records if at all necessary. \u003c/li\u003e\n\u003cli\u003eAttempting to execute actions that disrupt the availability of our systems (e.g. any volumetric or denial of service attacks)\u003c/li\u003e\n\u003cli\u003ePosting, transmit, upload, link to, send, or store any malicious software \u003c/li\u003e\n\u003cli\u003eTesting in a manner that would result in the sending of unsolicited or unauthorized junk mail, SMS, spam, or other forms of duplicative or unsolicited messages\u003c/li\u003e\n\u003cli\u003eTesting in a manner that would degrade the performance or operation of any system\u003c/li\u003e\n\u003cli\u003eTesting third-party applications, websites, or services that integrate with or link to our systems \u003c/li\u003e\n\u003cli\u003eMaking any changes to the system configurations, files, or data\u003c/li\u003e\n\u003cli\u003eIntroducing a backdoor in any system \u003c/li\u003e\n\u003cli\u003eConducting non-technical attacks such as social engineering or phishing\u003c/li\u003e\n\u003cli\u003eAttacking/interacting with our end users in any way.\u003c/li\u003e\n\u003cli\u003eEngaging in the trade of stolen/breached user credentials or use leaked credential dumps in the testing (no credential stuffing is allowed)\u003c/li\u003e\n\u003cli\u003eReporting any DMARC related issue for any in-scope domain\u003c/li\u003e\n\u003cli\u003ePlease give Majid 15 business days to apply any official patches for public zero-day vulnerabilities. Any submissions that are made prior to that window being closed will not be accepted.\u003c/li\u003e\n\u003cli\u003eCredential leaks reports are appreciated, but they are not eligible for reward.\u003c/li\u003e\n\u003cli\u003eAuthentication issues on \u003ca href=\"https://identity.majidalfuttaim.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://identity.majidalfuttaim.com/\u003c/a\u003e must be reported to our \u003ca href=\"https://bugcrowd.com/mpass-og\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eMPASS program\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"fb1c077b-8b42-46cc-a60c-3f445b08ccdd","name":"In Scope Targets","targets":[{"id":"02338b0e-be9c-4c7e-81a2-fb3f5f2b1009","uri":"https://www.crateandbarrel.me","name":"www.crateandbarrel.me","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bdcec49b-c27d-4110-bf7a-293264460906","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"02338b0e-be9c-4c7e-81a2-fb3f5f2b1009"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"02338b0e-be9c-4c7e-81a2-fb3f5f2b1009"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"02338b0e-be9c-4c7e-81a2-fb3f5f2b1009"},{"id":"9558d6b3-9880-4506-9e19-55dc1d7d8aff","name":"RequireJS","targetId":"02338b0e-be9c-4c7e-81a2-fb3f5f2b1009"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"02338b0e-be9c-4c7e-81a2-fb3f5f2b1009"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"02338b0e-be9c-4c7e-81a2-fb3f5f2b1009"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"02338b0e-be9c-4c7e-81a2-fb3f5f2b1009"}],"recentChangeFlags":null},{"id":"52a0a504-f709-4876-80a7-9ae7ccc91394","uri":"https://api-prod.thatconceptstore.com/","name":"https://api-prod.thatconceptstore.com/","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4618dc70-eac4-4887-9de8-ebfb1f642965","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"52a0a504-f709-4876-80a7-9ae7ccc91394"}],"recentChangeFlags":null},{"id":"bfe5148e-19ab-41bb-adf7-cebfffd8f610","uri":"https://apps.apple.com/app/id1503045795","name":"THAT Concept Store iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1ca4871c-8459-4023-a548-dc040c2d4302","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"bfe5148e-19ab-41bb-adf7-cebfffd8f610"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"bfe5148e-19ab-41bb-adf7-cebfffd8f610"}],"recentChangeFlags":null},{"id":"7d5a3387-196a-409d-bc15-7d11a9cc612e","uri":"https://play.google.com/store/apps/details?id=com.maf.thatandroid","name":"THAT Concept Store Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"557c24bd-273b-439f-bf0a-d6e4cca57cb7","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"7d5a3387-196a-409d-bc15-7d11a9cc612e"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"7d5a3387-196a-409d-bc15-7d11a9cc612e"}],"recentChangeFlags":null},{"id":"7fbc0e3e-6249-47f4-93ee-bcf00ffa2744","uri":"https://thatconceptstore.com","name":"https://thatconceptstore.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d4a20b06-a67f-46b4-8b51-0a7ec1e06ecf","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"7fbc0e3e-6249-47f4-93ee-bcf00ffa2744"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7fbc0e3e-6249-47f4-93ee-bcf00ffa2744"}],"recentChangeFlags":null},{"id":"9bf9c27a-d55e-4c09-8508-5976dc6465fb","uri":"https://www.cb2.ae/en","name":"https://www.cb2.ae/en","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cc98d7dc-5d7d-4a35-ad7b-31654da3f1e8","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"9bf9c27a-d55e-4c09-8508-5976dc6465fb"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9bf9c27a-d55e-4c09-8508-5976dc6465fb"},{"id":"e4ad1c44-2f86-487b-9793-0add0dbfdcf2","name":"Zone.js","targetId":"9bf9c27a-d55e-4c09-8508-5976dc6465fb"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"9bf9c27a-d55e-4c09-8508-5976dc6465fb"}],"recentChangeFlags":null},{"id":"c41be79d-272b-4f3c-a44e-274c2e83d108","uri":"https://www.allsaints.me/","name":"https://www.allsaints.me/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b73fbeb0-d1b3-4ca9-b080-78038e648390","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"c41be79d-272b-4f3c-a44e-274c2e83d108"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c41be79d-272b-4f3c-a44e-274c2e83d108"},{"id":"e4ad1c44-2f86-487b-9793-0add0dbfdcf2","name":"Zone.js","targetId":"c41be79d-272b-4f3c-a44e-274c2e83d108"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"c41be79d-272b-4f3c-a44e-274c2e83d108"}],"recentChangeFlags":null},{"id":"c2a71e36-35f8-4f6b-b207-653696240440","uri":"https://www.lululemon.me","name":"www.lululemon.me","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"083cc200-b4d0-4229-890e-33f682faddce","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"c2a71e36-35f8-4f6b-b207-653696240440"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c2a71e36-35f8-4f6b-b207-653696240440"},{"id":"e4ad1c44-2f86-487b-9793-0add0dbfdcf2","name":"Zone.js","targetId":"c2a71e36-35f8-4f6b-b207-653696240440"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"c2a71e36-35f8-4f6b-b207-653696240440"}],"recentChangeFlags":null},{"id":"8baa9a10-f6ba-4f92-a635-3d01a570599d","uri":"https://lapi.yellowblocks.me","name":"lapi.yellowblocks.me","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"97a3b60b-32b8-411e-9366-85a321595f80","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"8baa9a10-f6ba-4f92-a635-3d01a570599d"}],"recentChangeFlags":null},{"id":"7f21a423-e6a0-4aee-b533-0f5925d2fe1f","uri":"https://www.shiseido.me/","name":"https://www.shiseido.me/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cdefbc6d-a6d5-4d26-ada0-41ff983e4ca2","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"7f21a423-e6a0-4aee-b533-0f5925d2fe1f"}],"recentChangeFlags":null},{"id":"559d62d7-7958-47c1-b195-c374a2ae0678","uri":"","name":"lego.me","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"07258596-65a4-4e40-9421-6e7705b81543","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null},{"id":"028cb8d4-7c74-44af-8543-37dae8632e39","uri":"","name":"psychobunny.me","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f7ae3882-c739-4efe-9919-421a94e7cdfb","sortOrder":11},"sortOrder":11,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"028cb8d4-7c74-44af-8543-37dae8632e39"},{"id":"3d0125f6-ca7c-42bf-be0e-ad8fed63bc85","name":"Algolia","targetId":"028cb8d4-7c74-44af-8543-37dae8632e39"}],"recentChangeFlags":null},{"id":"0cc6b311-865b-4adc-a6cb-dcbaae9b11f4","uri":"","name":"fashion4less.me","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"00939891-ad26-4c9e-a944-209ebec790b9","sortOrder":12},"sortOrder":12,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"628bc8f1-aec0-48a1-bfef-525d4b1cf0ae","p1MaxCents":350000,"p1MinCents":300000,"p2MaxCents":250000,"p2MinCents":210000,"p3MaxCents":100000,"p3MinCents":30000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":3000,"max":3500},"2":{"min":2100,"max":2500},"3":{"min":300,"max":1000},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"e8848d8c-c70e-4026-a2ca-d712fc845736","name":"Out of scope","targets":[{"id":"983eac74-6cba-4234-8e15-901aaf1a04cd","uri":null,"name":"www.americangirlmena.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bd0c50c5-38ae-4f72-902f-57139c63bf9d","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"983eac74-6cba-4234-8e15-901aaf1a04cd"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"fd141ccb-2630-458e-aa38-c902e7579ff1","code":"maffashion","state":"in_progress","endsAt":null,"bountyId":"f103cff3-1595-4cc9-94a6-81571359f59a","startsAt":"2019-11-05T19:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/480b/1947/689eee82/2658f638f48cd7822caf5e960feea859_logo_2.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2019-11-05T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/maffashion","changelogs":"/engagements/maffashion/changelog","submissions":null,"announcements":"/engagements/maffashion/announcements","hallOfFame":"/engagements/maffashion/hall_of_fames","crowdstream":null},"announcementsCount":6,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/maffashion/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=maffashion\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/maffashion/engagement_subscribers","engagementChangelogsUrl":"/engagements/maffashion/changelog","publishedAt":"2025-09-01T15:47:05.385Z","engagementChangelogUrl":"/engagements/maffashion/changelog/17e7a8a3-0049-417f-956e-6f7ae42679d0","createUserFeedbacksUrl":"/engagements/maffashion/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}