{"id":"0eb3c506-d8ac-41ee-b469-3e0c2778dd1b","engagementId":"e92dd756-2d4f-4be6-9dbd-d5159f2b6a06","data":{"brief":{"id":"32dd9c88-4e09-4cbd-8399-93597ad8169b","name":"Mastercard Public Bug Bounty ","tagline":"Mastercard operates the world’s fastest payments processing network, connecting consumers, financial institutions, merchants, governments and businesses in more than 210 countries and territories. ","description":"\u003ch2\u003eProgram Details\u003c/h2\u003e\n\n\u003cp\u003eMastercard is the leading technology company in the worldwide payments industry. We run the fastest payments processing network in the world, tying together consumers, financial institutions, merchants, and governments across more than 210 nations and territories. Everyday commerce activities like buying, travelling, operating a business, and managing finances are made simpler, more secure, and more effective for everyone by Mastercard products and solutions. Mastercard is dedicated to increasing digital security as payment systems develop, which includes thorough testing for any vulnerabilities. By letting us know about any weaknesses, you can earn rewards while also assisting us in making our products and services even safer.\u003c/p\u003e\n\n\u003ch2\u003eEligibility for Participation\u003c/h2\u003e\n\n\u003cp\u003eTo be eligible for the Mastercard Bug Bounty Program, \u003cstrong\u003eyou must not\u003c/strong\u003e:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eBe a resident of, or make your submission from a country against which the United States has issued export sanctions or other trade restrictions (e.g., Russia, Iran, North Korea, and Syria) \u003c/li\u003e\n\u003cli\u003eBe in violation of any national, state, or local law or regulation.\u003c/li\u003e\n\u003cli\u003eBe employed by Mastercard or its subsidiaries.\u003c/li\u003e\n\u003cli\u003eBe an immediate family member of a person employed b Mastercard or its subsidiaries or affiliates. \u003c/li\u003e\n\u003cli\u003eBe less than 14 years of age. If you are at least 14 years old but are considered a minor in your place of residence, you must get your parent’s or legal guardian’s permission prior to participating in the program.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIf Mastercard discovers that you meet any of the criteria above, you will be excluded from the Mastercard Bug Bounty program and be disqualified from receiving any Bounty payments.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eMastercard Regional Sites:\u003c/strong\u003e\u003cbr\u003e\nThe regional MasterCard sites are the company’s external websites, which include public information available to unauthenticated users. The sites include outbound links to resources not hosted on the www.mastercard.com domain. Only the core MasterCard domain is in scope and open to testing. Please be mindful of which domain / sub domain you are testing.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003ePriceless\u003c/strong\u003e: (https://demo.priceless.com)\u003cbr\u003e\nPriceless Cities is a core tenet of MasterCard’s world-renowned 18 year-old Priceless marketing platform that is currently available in 112 countries and 53 languages. The platform provides exclusive curated experiences and special access in over 35 cities marketed in over 52 countries.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAccounts can be self-provisioned by using your @bugcrowdninja email.\u003c/li\u003e\n\u003cli\u003ePlease use 5555 5555 5555 4444 to register and test orders on demo.priceless.com.\u003c/li\u003e\n\u003cli\u003eNote: \u0026lt;www.priceless.com\u0026gt; was earlier part of bug bounty program but now we have replaced it with test environment \u0026lt;demo.priceless.com\u0026gt; so if similar issues are reported for this, it will be marked as duplicate\u003c/li\u003e\n\u003cli\u003eIn scope target \u0026lt;demo.priceless.com\u0026gt; is guarded by HTTP authentication use below username and password for login:\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eUsername: mastercard Password: priceLESS. For rest of the applications, no specific test data is required.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eMastermind Application:\u003c/strong\u003e\u003cbr\u003e\nAll tests to be performed on this URL:\u003cbr\u003e\nhttps://performancemarketing.mastercard.com/portal/ \u003c/p\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eSRC\u003c/strong\u003e:\u003cbr\u003e\nMastercard Click to Pay service (SRC - Secure Remote Commerce) is the sole target of this engagement. This service provides a fast and convenient checkout experience to customers on online stores.\u003c/p\u003e\n\n\u003cp\u003eTo facilitate your testing we have set up a test store https://masterpassteststore.com/ with the SRC integration (Masterpass) enabled. Please note that the store itself is Out of Scope and only the Masterpass functionality is in scope.\u003cbr\u003e\nPlease review the resources section to understand how to get to the in-scope target from a traditional online store.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eMDES CS API:\u003c/strong\u003e\u003cbr\u003e\nTargets are accessible through public internet. Please review below attached files for this engagement and insomnia is recommended software to use in order to run those files. Also, Mastercard API plugin needs to be downloaded to be properly authenticated.\u003cbr\u003e\nAdditionally, please follow the link for additional information regarding the API functionality.\u003c/p\u003e\n\n\u003cp\u003e• MDES%20In-scope.txt (in-scope endpoint details)\u003cbr\u003e\n• Environment_MTF_CSAPI.txt  (Environment variable)\u003cbr\u003e\n• BBTestUser-production.p12 (P12 file)\u003cbr\u003e\n• Insomnia_2023-01-11.json (Insomnia collection)\u003c/p\u003e\n\n\u003cp\u003eMDES MTF Account Ranges \u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eRange Star No#\u003c/th\u003e\n\u003cth\u003eRange End No#\u003c/th\u003e\n\u003cth\u003eBrand\u003c/th\u003e\n\u003cth\u003eCountry Code\u003c/th\u003e\n\u003cth\u003eCust ID\u003c/th\u003e\n\u003cth\u003eLength\u003c/th\u003e\n\u003cth\u003eFPANs\u003c/th\u003e\n\u003cth\u003eReserved\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e5204245250000000000\u003c/td\u003e\n\u003ctd\u003e5204245259999999999\u003c/td\u003e\n\u003ctd\u003eMCC\u003c/td\u003e\n\u003ctd\u003e840 (USA)\u003c/td\u003e\n\u003ctd\u003e144136\u003c/td\u003e\n\u003ctd\u003e16\u003c/td\u003e\n\u003ctd\u003e5204245250000084/5204245250000092\u003c/td\u003e\n\u003ctd\u003eeCom\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e5204490310000000000\u003c/td\u003e\n\u003ctd\u003e5204490319999999999\u003c/td\u003e\n\u003ctd\u003eMCC\u003c/td\u003e\n\u003ctd\u003e840\u003c/td\u003e\n\u003ctd\u003e144136\u003c/td\u003e\n\u003ctd\u003e16\u003c/td\u003e\n\u003ctd\u003e5204490310000217/5204490310000225\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003e\u003cstrong\u003eDXP: (Mastercard Donate)\u003c/strong\u003e\u003cbr\u003e\nResearchers are encouraged to create their own accounts by visiting this page:  https://donate.mastercard.com/wfp/en-it.html and signing up. \u003c/p\u003e\n\n\u003cp\u003eWhen signing up, please use the following credit card info:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCard number: 5333170000000008, 5333170000000057\u003c/li\u003e\n\u003cli\u003eExpiration: 09/24\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eCVC: 464\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eFinicity:\u003c/h3\u003e\n\n\u003cp\u003eFor Finicity - OBB (Open Banking Business Service) please follow the resources tab in there you will find all the necessary information to connect this API.\u003c/p\u003e\n\n\u003cp\u003eFor www.finicity .com the In Scope functionalities are: \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eSolutions (all the tabs + sub-tabs)\u003c/li\u003e\n\u003cli\u003eUse Cases (all the tabs + sub-tabs)\u003c/li\u003e\n\u003cli\u003eAbout (all the tabs + sub-tabs)\u003c/li\u003e\n\u003cli\u003eDeveloper (all the tabs + sub-tabs)\u003c/li\u003e\n\u003cli\u003eLogin (Only client hub tab)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eFor Consumer Portal Bug Bounty User Testing:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eConsumers (here, Bug Bounty Test User with their @bugcrowdninja email IDs)\nshould test the application through this\nURL: https://consumer.finicityreports.com/login\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRegistration:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eConsumer portal user can do the self-registration to the portal with their\nemail address on https://consumer.finicityreports.com/signup \u003c/li\u003e\n\u003cli\u003eThey can setup their account with the First Name, Last Name, SSN and DOB.\n(Refer ‘Dummy Set of SSN and DOB’ given at the end of document below)\u003c/li\u003e\n\u003cli\u003eOnce done Consumer will get redirected to the dashboard which will display\nthe reports for the consumers and disputes raised by the consumer.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLogin:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eConsumer (Bug Bounty Test User) should login application through this\nURL https://consumer.finicityreports.com/login with the email address used\nfor Registration. i.e., @bugcrowdninja email\u003c/li\u003e\n\u003cli\u003eOn successful login consumer will see the dashboard which will display the\nreports for the consumers and disputes raised by the consumer.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDummy Set of SSN and DOB:\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003col\u003e\n\u003cli\u003eSSN: 777777777 DOB: 7th July 1997\u003c/li\u003e\n\u003cli\u003eSSN: 222222222 DOB: 2nd February 2002\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003eOut of Scope:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eGet Started \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eFor Finicity- Open Banking Payment History application please follow the resources tab in there you will find all the necessary information to connect this API.\u003c/p\u003e\n\n\u003cp\u003e7 files attached in this brief to access the in-scope services:\u003cbr\u003e\n• OpenAPI specification for Finicity APIs\u003cbr\u003e\n• DS.postman_environment.json\u003cbr\u003e\n• Finicity_DSAPI_COLLECTION.postman_collection.json\u003cbr\u003e\n• Finicity%20Decisioning.postman_collection.json\u003cbr\u003e\n• Prod.postman%20Decisioning_environment.json\u003cbr\u003e\n• Connect%20(Bug%20Bounty%20Test).postman_collection.json\u003cbr\u003e\n• Environment%20Placeholder.postman_environment.json\u003cbr\u003e\n• Connect%20Bug%20Bounty%20Guide.pdf\u003c/p\u003e\n\n\u003cp\u003eAlso, attaching steps to follow for Finicity- Data Services ‘TxPush Notification’ API endpoint: \u003cstrong\u003ePlease see resources tab\u003c/strong\u003e  \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eBug Submission Requirements\u003c/h2\u003e\n\n\u003cp\u003eDue to GDPR and legal requirements, all testing must be conducted using your @bugcrowdninja.com email ID only. If you fail to use your @Bugcrowdninja.com email ID, you run the risk of getting blocked from accessing Mastercard applications. \u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eFor all submissions, please include\u003c/strong\u003e:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eFull description of the vulnerability being reported, including the exploitability and impact.\u003c/li\u003e\n\u003cli\u003eEvidence and explanation of all steps required to reproduce the submission, which may include:\u003c/li\u003e\n\u003cli\u003eVideos\u003c/li\u003e\n\u003cli\u003eScreenshots\u003c/li\u003e\n\u003cli\u003eExploit code\u003c/li\u003e\n\u003cli\u003eTraffic logs\u003c/li\u003e\n\u003cli\u003eWeb/API requests and responses\u003c/li\u003e\n\u003cli\u003eEmail address or user ID of any test accounts\u003c/li\u003e\n\u003cli\u003eIP address used during testing.\u003c/li\u003e\n\u003cli\u003eFor Remote Code Execution submissions, see below.\u003c/li\u003e\n\u003cli\u003e Failure to include Email address or user ID of any test accounts and IP address used during testing will result in a 10% penalty against bounty payout.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eLeaked Credentials\u003c/h3\u003e\n\n\u003cp\u003eIf you happen to identify vulnerabilities involving data that has been exposed or leaked such as dark web forums or leaked credential sites. You can report it to this engagement. However, be aware that it is only eligible for points-based compensation. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance.\u003c/p\u003e\n\n\u003ch3\u003eRemote Code Execution (RCE) Submission Guidelines:\u003c/h3\u003e\n\n\u003cp\u003eFailure to meet the below conditions and requirements could result in a forfeiture of any potential Bounty Payment.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eSource IP address\u003c/li\u003e\n\u003cli\u003eTimestamp, including time zone.\u003c/li\u003e\n\u003cli\u003eFull server request and responses\u003c/li\u003e\n\u003cli\u003eFilenames of any uploaded files, which must include “bugbounty” and the timestamp.\u003c/li\u003e\n\u003cli\u003eCall-back IP and port, if applicable\u003c/li\u003e\n\u003cli\u003eAny data that was accessed, either deliberately or inadvertently\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eAllowed Actions:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eDirectly injecting benign commands via the web application or interface (e.g., whoami, hostname, ifconfig)\u003c/li\u003e\n\u003cli\u003eUploading a file that outputs the result of a hard-coded benign command.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eProhibited Actions:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eUploading files that allow arbitrary commands (i.e., a webshell)\u003c/li\u003e\n\u003cli\u003eModifying any files or data, including permissions\u003c/li\u003e\n\u003cli\u003eDeleting any files or data\u003c/li\u003e\n\u003cli\u003eInterrupting normal operations (e.g., triggering a reboot)\u003c/li\u003e\n\u003cli\u003eCreating and maintaining a persistent connection to the server\u003c/li\u003e\n\u003cli\u003eIntentionally viewing any files or data beyond what is needed to prove the vulnerability.\u003c/li\u003e\n\u003cli\u003eFailing to disclose any actions taken or applicable required information.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eProhibited Testing:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eUse of automated scanners and tools to find vulnerabilities is strictly not allowed. Mastercard requests that testers do not perform automated/scripted testing of web forms, especially \"Contact Us\" forms that are designed for customers to contact the Support team.\u003c/li\u003e\n\u003cli\u003eApplications under Public Targets are mostly production applications. Do not deface/add random content in case you find some stored injection/ RCE. Report back to us with PoC and we will test fully in a lower environment (if required)\u003c/li\u003e\n\u003cli\u003eDo NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure are not allowed.\u003c/li\u003e\n\u003cli\u003eDo NOT test the physical security of Mastercard offices, employees, equipment, etc.\u003c/li\u003e\n\u003cli\u003eDo NOT perform any attack that could harm our services (E.g.: DDoS/Spam).\u003c/li\u003e\n\u003cli\u003eDo NOT attack, in any way, our end users, or engage in trade of stolen user credentials.\u003c/li\u003e\n\u003cli\u003eYou may investigate or target vulnerabilities against your own or test accounts, but testing must not disrupt or compromise any data or data access that is not yours.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eConfidentiality\u003c/strong\u003e: If your testing or investigation inadvertently causes a privacy violation or disruption (such as accessing account data, service configurations, or other confidential information), please include this information in your report (or email support@bugcrowd.com)\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eIn-scope \u0026amp; Out of scope Vulnerabilities:\u003c/h2\u003e\n\n\u003ch3\u003eIn-scope focused vulnerabilities:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eCross Site Scripting (XSS)\u003c/li\u003e\n\u003cli\u003eCross Site Request Forgery (CSRF)\u003c/li\u003e\n\u003cli\u003eInsecure direct object references\u003c/li\u003e\n\u003cli\u003eInjection Vulnerabilities\u003c/li\u003e\n\u003cli\u003eAuthentication Vulnerabilities\u003c/li\u003e\n\u003cli\u003eServer-side Code Execution\u003c/li\u003e\n\u003cli\u003ePrivilege Escalation\u003c/li\u003e\n\u003cli\u003eSignificant Security Misconfiguration (when not caused by user)\u003c/li\u003e\n\u003cli\u003eAny out of the box issues which could lead to compromise or leakage of data and directly affect the confidentiality or integrity of user data of which affects user privacy.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eOut of Scope vulnerabilities specifically excluded from the bounty:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003ePivoting, scanning, and vulnerability exploitation.\u003c/li\u003e\n\u003cli\u003eExfiltration of data from Mastercard systems.\u003c/li\u003e\n\u003cli\u003eEmail spoofing\u003c/li\u003e\n\u003cli\u003eMissing or incorrect SPF/DMARC/DKIM records of any kind\u003c/li\u003e\n\u003cli\u003eDescriptive error messages (e.g., Stack Traces, application or server errors).\u003c/li\u003e\n\u003cli\u003eFingerprinting / banner disclosure on common/public services.\u003c/li\u003e\n\u003cli\u003eClickjacking and issues only exploitable through clickjacking.\u003c/li\u003e\n\u003cli\u003eLogin/Logout/Unauthenticated/low impact/anonymous user CSRF.\u003c/li\u003e\n\u003cli\u003ePresence of application or web browser ‘autocomplete’ or ‘save password’ functionality.\u003c/li\u003e\n\u003cli\u003eLack of Secure/HTTPOnly flags on non-sensitive Cookies.\u003c/li\u003e\n\u003cli\u003eLack of Security Speedbump when leaving the site.\u003c/li\u003e\n\u003cli\u003eWeak Captcha / Captcha Bypass\u003c/li\u003e\n\u003cli\u003eForgot Password page brute force and account lockout not enforced.\u003c/li\u003e\n\u003cli\u003eUsername / email enumeration\u003c/li\u003e\n\u003cli\u003evia Login Page error message\u003c/li\u003e\n\u003cli\u003evia Forgot Password error message\u003c/li\u003e\n\u003cli\u003eAny missing/misconfigured HTTP security headers\u003c/li\u003e\n\u003cli\u003eSSL Issues, e.g.\n\n\u003cul\u003e\n\u003cli\u003e     SSL Attacks such as BEAST, BREACH, Renegotiation attack\u003c/li\u003e\n\u003cli\u003e     SSL Forward secrecy not enabled.\u003c/li\u003e\n\u003cli\u003e     SSL weak / insecure cipher suites\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting users of outdated browsers \n\n\u003cul\u003e\n\u003cli\u003eIE \u0026lt; 9\u003c/li\u003e\n\u003cli\u003eChrome \u0026lt; 40\u003c/li\u003e\n\u003cli\u003eFirefox \u0026lt; 35\u003c/li\u003e\n\u003cli\u003eSafari \u0026lt; 7, Opera \u0026lt; 13\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of scope:\u003c/h2\u003e\n\n\u003cp\u003eOnly the targets that are indicated as “In-Scope” above may be tested. Any Mastercard website or asset not specifically mentioned in the “In-Scope” section is out of scope for this program. If you find a security flaw on a target that is outside of the scope but clearly affects Mastercard, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003ch3\u003eSimplify:\u003c/h3\u003e\n\n\u003cp\u003e• If a link goes outside the www.simplify.com or sandbox.simplify.com domains, it is no longer in scope and should not be tested.\u003cbr\u003e\n• Simplify has two live partners Priority Payment Systems, EVO Payment Systems which are explicitly out of scope.\u003c/p\u003e\n\n\u003ch3\u003eMastercard Regional Sites:\u003c/h3\u003e\n\n\u003cp\u003e• The regional sites include outbound links to resources not hosted on the www.mastercard.com domain. Only the core MasterCard domain is in scope and open to testing.\u003c/p\u003e\n\n\u003ch3\u003eDeveloper Portal:\u003c/h3\u003e\n\n\u003cp\u003eAll Available Mastercard Developer APIs \u003cbr\u003e\n(The APIs for the developer portal are fully out of scope for this. You may either use an existing account, or create new users are needed using your \u0026lt;@bugcrowdninja.com\u0026gt; address.)\u003c/p\u003e\n\n\u003ch3\u003ePriceless:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003edemo.priceless.com/travel\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003e           demo.priceless.com/standup \u003c/li\u003e\n\u003cli\u003e           Order placement on demo.priceless.com\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eMastermind application:\u003c/h3\u003e\n\n\u003cp\u003eYou are testing on production. Behaviour that compromises the stability and integrity of the site should be out of scope. For example, do not target other user's data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it.\u003c/p\u003e\n\n\u003ch3\u003eSRC:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003ehttps://masterpassteststore.com/-\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003ehttps://www.mastercard.us/en-us/personal/ways-to-pay/click-to-pay.html-\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003ehttps://checkout.mastercard.com/-\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003ehttps://secure.checkout.visa.com/*\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003ePlease note that the store itself is Out of Scope and only the Masterpass functionality is in scope.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"c33900b5-7569-46fd-a4fb-52c074cd07ba","name":"Public Targets (In-scope)","targets":[{"id":"67c0d1d9-9c9e-40d3-8f1b-71efd8031b88","uri":"https://www.mastercard.us/en-us.html","name":"MasterCard.us - www.mastercard.us/en-us.html","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"98c81e43-1ad6-481f-ab5b-1991319484c1","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"67c0d1d9-9c9e-40d3-8f1b-71efd8031b88"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"67c0d1d9-9c9e-40d3-8f1b-71efd8031b88"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"67c0d1d9-9c9e-40d3-8f1b-71efd8031b88"},{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"67c0d1d9-9c9e-40d3-8f1b-71efd8031b88"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"67c0d1d9-9c9e-40d3-8f1b-71efd8031b88"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"67c0d1d9-9c9e-40d3-8f1b-71efd8031b88"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"67c0d1d9-9c9e-40d3-8f1b-71efd8031b88"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"67c0d1d9-9c9e-40d3-8f1b-71efd8031b88"}],"recentChangeFlags":null},{"id":"1aa65d3e-0b93-4b2f-8a2d-356485584e4e","uri":"https://www.mastercard.ch/de-ch.html","name":"MasterCard.ch - (German) - www.mastercard.ch/de-ch.html","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d9be7673-9ba5-44e8-b1ae-26b2873cd21c","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"1aa65d3e-0b93-4b2f-8a2d-356485584e4e"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"1aa65d3e-0b93-4b2f-8a2d-356485584e4e"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"1aa65d3e-0b93-4b2f-8a2d-356485584e4e"},{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"1aa65d3e-0b93-4b2f-8a2d-356485584e4e"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"1aa65d3e-0b93-4b2f-8a2d-356485584e4e"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"1aa65d3e-0b93-4b2f-8a2d-356485584e4e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1aa65d3e-0b93-4b2f-8a2d-356485584e4e"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"1aa65d3e-0b93-4b2f-8a2d-356485584e4e"}],"recentChangeFlags":null},{"id":"ae0a1a08-b59b-4a84-9e46-05d2baf77092","uri":"https://www.mastercard.ch/fr-ch.html","name":"MasterCard.ch - (French) - www.mastercard.ch/fr-ch.html","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f87ccb16-89d7-4b4b-a199-9ec219f3a6d8","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"ae0a1a08-b59b-4a84-9e46-05d2baf77092"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"ae0a1a08-b59b-4a84-9e46-05d2baf77092"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"ae0a1a08-b59b-4a84-9e46-05d2baf77092"},{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"ae0a1a08-b59b-4a84-9e46-05d2baf77092"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"ae0a1a08-b59b-4a84-9e46-05d2baf77092"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"ae0a1a08-b59b-4a84-9e46-05d2baf77092"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ae0a1a08-b59b-4a84-9e46-05d2baf77092"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"ae0a1a08-b59b-4a84-9e46-05d2baf77092"}],"recentChangeFlags":null},{"id":"56a5a054-efec-4b4d-b3e3-5f138fed3d05","uri":"https://www.mastercard.com.au/en-au.html","name":"MasterCard.com.au - www.mastercard.com.au/en-au.html","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"658d1b4f-ea8a-4d13-ac01-dbf18a3ba14a","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"56a5a054-efec-4b4d-b3e3-5f138fed3d05"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"56a5a054-efec-4b4d-b3e3-5f138fed3d05"},{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"56a5a054-efec-4b4d-b3e3-5f138fed3d05"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"56a5a054-efec-4b4d-b3e3-5f138fed3d05"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"56a5a054-efec-4b4d-b3e3-5f138fed3d05"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"56a5a054-efec-4b4d-b3e3-5f138fed3d05"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"56a5a054-efec-4b4d-b3e3-5f138fed3d05"}],"recentChangeFlags":null},{"id":"642e2018-053b-409f-9afd-22fca624cdf1","uri":"https://www.mastercard.nl/nl-nl.html","name":"MasterCard.nl - www.mastercard.nl/nl-nl.html","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f76017b9-4d62-4ce9-a2c6-44ecf98ff3d5","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"642e2018-053b-409f-9afd-22fca624cdf1"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"642e2018-053b-409f-9afd-22fca624cdf1"},{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"642e2018-053b-409f-9afd-22fca624cdf1"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"642e2018-053b-409f-9afd-22fca624cdf1"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"642e2018-053b-409f-9afd-22fca624cdf1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"642e2018-053b-409f-9afd-22fca624cdf1"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"642e2018-053b-409f-9afd-22fca624cdf1"}],"recentChangeFlags":null},{"id":"61f53ffb-e2ca-4a16-a258-e3d88c624772","uri":"https://developer.mastercard.com","name":"https://developer.mastercard.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e47b196c-7832-43c9-ae0a-7888423391dd","sortOrder":0},"sortOrder":0,"tags":[{"id":"0ce93ddf-31a4-4663-b1ca-9a1ac7da35a3","name":"Stripe","targetId":"61f53ffb-e2ca-4a16-a258-e3d88c624772"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"61f53ffb-e2ca-4a16-a258-e3d88c624772"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"61f53ffb-e2ca-4a16-a258-e3d88c624772"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"61f53ffb-e2ca-4a16-a258-e3d88c624772"}],"recentChangeFlags":null},{"id":"af47c2a8-b0b8-45a2-8197-a973aa75cae8","uri":"https://donate.mastercard.com","name":"donate.mastercard.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"be04925a-12e2-412e-8eab-45496de88697","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"af47c2a8-b0b8-45a2-8197-a973aa75cae8"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"af47c2a8-b0b8-45a2-8197-a973aa75cae8"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"af47c2a8-b0b8-45a2-8197-a973aa75cae8"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"af47c2a8-b0b8-45a2-8197-a973aa75cae8"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"af47c2a8-b0b8-45a2-8197-a973aa75cae8"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"af47c2a8-b0b8-45a2-8197-a973aa75cae8"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"af47c2a8-b0b8-45a2-8197-a973aa75cae8"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"af47c2a8-b0b8-45a2-8197-a973aa75cae8"}],"recentChangeFlags":null},{"id":"38f9ddc3-7662-479f-8797-cb2a59917ac5","uri":"https://demo.priceless.com/","name":"Core Priceless.com - demo.priceless.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"135451f9-e744-42d3-a21e-9fa80a57e96f","sortOrder":0},"sortOrder":0,"tags":[{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"38f9ddc3-7662-479f-8797-cb2a59917ac5"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"38f9ddc3-7662-479f-8797-cb2a59917ac5"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"38f9ddc3-7662-479f-8797-cb2a59917ac5"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"38f9ddc3-7662-479f-8797-cb2a59917ac5"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"38f9ddc3-7662-479f-8797-cb2a59917ac5"}],"recentChangeFlags":null},{"id":"cf86cd40-4566-47a3-931d-497d717c8b24","uri":"https://priceless.com/golf/","name":"https://priceless.com/golf/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3431ca75-f878-4795-837e-eaac60630684","sortOrder":0},"sortOrder":0,"tags":[{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"cf86cd40-4566-47a3-931d-497d717c8b24"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"cf86cd40-4566-47a3-931d-497d717c8b24"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"cf86cd40-4566-47a3-931d-497d717c8b24"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"cf86cd40-4566-47a3-931d-497d717c8b24"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"cf86cd40-4566-47a3-931d-497d717c8b24"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cf86cd40-4566-47a3-931d-497d717c8b24"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"cf86cd40-4566-47a3-931d-497d717c8b24"}],"recentChangeFlags":null},{"id":"bd79305c-d3d0-433d-80b4-6b45f3329838","uri":"https://performancemarketing.mastercard.com/portal/","name":"https://performancemarketing.mastercard.com/portal/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a56354ef-5d63-479a-8638-32945f94db56","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"bd79305c-d3d0-433d-80b4-6b45f3329838"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"bd79305c-d3d0-433d-80b4-6b45f3329838"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"bd79305c-d3d0-433d-80b4-6b45f3329838"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bd79305c-d3d0-433d-80b4-6b45f3329838"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"bd79305c-d3d0-433d-80b4-6b45f3329838"}],"recentChangeFlags":null},{"id":"0ac29acf-a0a1-4461-9a28-d23abc8e2a17","uri":"https://src.mastercard.com/profile/enroll","name":"https://src.mastercard.com/profile/enroll","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e8dc66be-b5d7-40fa-857f-7956ff94fec3","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0ac29acf-a0a1-4461-9a28-d23abc8e2a17"},{"id":"ce8ff3cd-4d54-4404-8321-6351781551a3","name":"Vue.js","targetId":"0ac29acf-a0a1-4461-9a28-d23abc8e2a17"}],"recentChangeFlags":null},{"id":"8fae4133-e81d-4ed2-a035-273bacbb99ef","uri":null,"name":"https://src.mastercard.com/*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a621e175-0575-4303-ae5a-b3158224fa9f","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8fae4133-e81d-4ed2-a035-273bacbb99ef"}],"recentChangeFlags":null},{"id":"6c625a24-40ef-48cb-bca7-3bbac3cd1a03","uri":null,"name":"SRC integration on https://masterpassteststore.com/. Only the Masterpass checkout functionality is in scope","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3083de1f-50a1-4d62-ad5f-09fac34c8496","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6c625a24-40ef-48cb-bca7-3bbac3cd1a03"},{"id":"ce8ff3cd-4d54-4404-8321-6351781551a3","name":"Vue.js","targetId":"6c625a24-40ef-48cb-bca7-3bbac3cd1a03"}],"recentChangeFlags":null},{"id":"179294e6-1b8d-470e-9840-d26136edea0f","uri":"","name":" Finicity Connect","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a2e751fe-d12b-45ae-b0c2-9191a8be5a1a","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"179294e6-1b8d-470e-9840-d26136edea0f"}],"recentChangeFlags":null},{"id":"55c8a637-a05d-4fb3-8d1e-26a49d888015","uri":"","name":"Finicity- Data Services","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3000ab7e-a75c-4ab2-be46-fdb9cd25ca03","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"55c8a637-a05d-4fb3-8d1e-26a49d888015"}],"recentChangeFlags":null},{"id":"35b5e814-fb82-4087-b512-a5a6e4a8dd8a","uri":"","name":"Finicity Decisioning","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0e92864a-a05a-4d54-934a-b9a748d257f1","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"35b5e814-fb82-4087-b512-a5a6e4a8dd8a"}],"recentChangeFlags":null},{"id":"406dbed1-db58-414f-b539-835cdf9d3edb","uri":"https://www.finicity.com","name":"https://www.finicity.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8ca31803-e2a4-4002-af5c-02fa4b0df220","sortOrder":0},"sortOrder":0,"tags":[{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"406dbed1-db58-414f-b539-835cdf9d3edb"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"406dbed1-db58-414f-b539-835cdf9d3edb"}],"recentChangeFlags":null},{"id":"3049f28b-3bb8-47fe-9688-725fbaa18d05","uri":"https://consumer.finicityreports.com","name":"https://consumer.finicityreports.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c9216b1d-403a-46b9-baa1-65a3d22966c0","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3049f28b-3bb8-47fe-9688-725fbaa18d05"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"3049f28b-3bb8-47fe-9688-725fbaa18d05"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"3049f28b-3bb8-47fe-9688-725fbaa18d05"}],"recentChangeFlags":null},{"id":"a449bbf4-1767-41a6-ac59-92f5f75f3b90","uri":"","name":"Finicity- Open Banking Payment History application","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"046391f8-61bb-4a45-8093-7b610fb4301e","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"a449bbf4-1767-41a6-ac59-92f5f75f3b90"}],"recentChangeFlags":null},{"id":"e4c7d0b2-1993-41a2-b1d2-1dfb6c55b63b","uri":"","name":"Finicity - OBB (Open Banking Business Service) ","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e80cce0a-da38-4dde-9c54-794ece9bf4d2","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"e4c7d0b2-1993-41a2-b1d2-1dfb6c55b63b"}],"recentChangeFlags":null},{"id":"8122b22f-690e-4856-930b-66ea46e1037f","uri":"https://pioneer.truata.com/","name":"https://pioneer.truata.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3d971023-3f1d-4b33-8c85-989739945d37","sortOrder":21},"sortOrder":21,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8122b22f-690e-4856-930b-66ea46e1037f"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"918cf4c5-6024-451e-8268-d55087247219","p1MaxCents":500000,"p1MinCents":500000,"p2MaxCents":200000,"p2MinCents":200000,"p3MaxCents":100000,"p3MinCents":100000,"p4MaxCents":25000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":5000,"max":5000},"2":{"min":2000,"max":2000},"3":{"min":1000,"max":1000},"4":{"min":250,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"159e606e-eaf0-40d3-acdd-8c4738d46c5d","name":"Public Other Targets","targets":[{"id":"9d9ffbee-51ee-4729-83d0-2432ba9a5b64","uri":"","name":"Public Others Target","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"21d34be0-befc-47bf-b2c9-12135575941b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9d9ffbee-51ee-4729-83d0-2432ba9a5b64"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"751c090c-1cf8-4125-8439-bb86f8e22145","p1MaxCents":250000,"p1MinCents":70000,"p2MaxCents":100000,"p2MinCents":30000,"p3MaxCents":50000,"p3MinCents":15000,"p4MaxCents":15000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eIf you find a security flaw on a target that is outside of the scope mentioned under \u0026#39;Private\u0026#39; and \u0026#39;Public\u0026#39; Target but clearly affects Mastercard, you can report it at \u0026#39;\u0026#39;Public Other\u0026#39;\u0026#39; Program. \u003cbr\u003e\nAlso, findings related to Mergers and Acquisitions (M\u0026amp;A) could be considered under ‘Public Others’ category. \u003c/p\u003e\n\n\u003ch5\u003eVendor based application URLs/3rd party URLs:\u003c/h5\u003e\n\n\u003cp\u003eAny Partner Sites of Mastercard (e.g. www.mastercard-*.com) are mainly marketing based sites that are not part of the core Mastercard domains (.mastercard.com) and are managed by hosting vendor companies. Vulnerabilities on these assets will be awarded lower bounties:\u003c/p\u003e\n\n\u003ctable\u003e\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eP1\u003c/th\u003e\n\u003cth\u003eP2\u003c/th\u003e\n\u003cth\u003eP3\u003c/th\u003e\n\u003cth\u003eP4\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e$700\u003c/td\u003e\n\u003ctd\u003e$300\u003c/td\u003e\n\u003ctd\u003e$150\u003c/td\u003e\n\u003ctd\u003e$50\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\n\n\u003cp\u003eThe reward amount for submissions reported for any lower environment (such as stage, dev, test, sandbox, or UAT) of third-party developed (vendor) applications will be 50% of the standard amount mentioned in above table.\u003c/p\u003e\n\n\u003ch4\u003egive.mastercard.com is a vendor based application and bounty payouts will be according to this table.\u003c/h4\u003e\n\n\u003ch4\u003eRecorded Future has a separate bug bounty program. Submissions related to Recorded Future are out of scope for the Mastercard Bug Bounty Program.\u003c/h4\u003e\n\n\u003ch4\u003ebiz360.mastercard.com and mybiz360.mastercard.com are out of scope from Mastercard bug bounty program\u003c/h4\u003e\n\n\u003ch5\u003ePay-outs for Subdomain Takeover:\u003c/h5\u003e\n\n\u003cp\u003ePay-outs for Subdomain Takeover findings differ from the rewards listed above. Please review the severity and descriptions below before submitting a report.\u003c/p\u003e\n\n\u003ctable\u003e\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eImpact\u003c/th\u003e\n\u003cth\u003eSeverity\u003c/th\u003e\n\u003cth\u003eReward\u003c/th\u003e\n\u003cth\u003eDescription\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eHigh Impact Subdomain Takeover\u003c/td\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003ctd\u003e$900\u003c/td\u003e\n\u003ctd\u003eAwarded for domains and subdomains with reputational or technical risk. Also, for subdomains under a parent domain with reputational or technical risk, and access to sensitive data on that parent domain.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBasic Subdomain Takeover\u003c/td\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003e$300\u003c/td\u003e\n\u003ctd\u003eAwarded for domains and subdomains under a parent domain with reputational or technical risk, but without access to sensitive data on that parent domain.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eConcession award\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003e$100\u003c/td\u003e\n\u003ctd\u003eAwarded for domains and subdomains that are owned by Mastercard and have no risks except publicity risk (which is inherent in ownership)\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e","rewardRangeData":{"1":{"min":700,"max":2500},"2":{"min":300,"max":1000},"3":{"min":150,"max":500},"4":{"min":50,"max":150},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[{"id":"5f9296f3-1196-4c96-8beb-7852ea6ee192","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/5f9296f3-1196-4c96-8beb-7852ea6ee192","name":"Prod.postman%2520Decisioning_environment%20(2).json","filename":"Prod.postman%2520Decisioning_environment%20(2).json","description":null,"icon":"fileOther","size":2299,"sizeLabel":"2.25 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/5f9296f3-1196-4c96-8beb-7852ea6ee192"},{"id":"3d0b4137-e615-4e01-b1b5-ceec15723e85","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/3d0b4137-e615-4e01-b1b5-ceec15723e85","name":"Steps%20to%20follow_SRC.docx","filename":"Steps%20to%20follow_SRC.docx","description":null,"icon":"fileOther","size":17395,"sizeLabel":"17 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/3d0b4137-e615-4e01-b1b5-ceec15723e85"},{"id":"3d4983e3-a6b0-4025-b503-7884aa72b712","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/3d4983e3-a6b0-4025-b503-7884aa72b712","name":"Steps%2520to%2520follow%2520for%2520Finicity-%2520Data%2520Services%2520%25E2%2580%2598TxPush%2520Notification%25E2%2580%2599%2520API%2520endpoint.docx","filename":"Steps%2520to%2520follow%2520for%2520Finicity-%2520Data%2520Services%2520%25E2%2580%2598TxPush%2520Notification%25E2%2580%2599%2520API%2520endpoint.docx","description":null,"icon":"fileOther","size":16973,"sizeLabel":"16.6 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/3d4983e3-a6b0-4025-b503-7884aa72b712"},{"id":"61e5939b-b69e-458e-80b9-a69378d551b9","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/61e5939b-b69e-458e-80b9-a69378d551b9","name":"Environment_MTF_CSAPI.txt","filename":"Environment_MTF_CSAPI.txt","description":null,"icon":"fileOther","size":348,"sizeLabel":"348 Bytes","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/61e5939b-b69e-458e-80b9-a69378d551b9"},{"id":"7ba8e495-6038-4326-9036-b2a7599197a6","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/7ba8e495-6038-4326-9036-b2a7599197a6","name":"Finicity_DSAPI_COLLECTION.postman_collection%20(2).json","filename":"Finicity_DSAPI_COLLECTION.postman_collection%20(2).json","description":null,"icon":"fileOther","size":24630,"sizeLabel":"24.1 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/7ba8e495-6038-4326-9036-b2a7599197a6"},{"id":"3d67a1dd-3429-401c-80bb-d0c07130f74a","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/3d67a1dd-3429-401c-80bb-d0c07130f74a","name":"DS.postman_environment.json","filename":"DS.postman_environment.json","description":null,"icon":"fileOther","size":1076,"sizeLabel":"1.05 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/3d67a1dd-3429-401c-80bb-d0c07130f74a"},{"id":"254c76f8-2d66-4582-889e-5d91ef31d30a","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/254c76f8-2d66-4582-889e-5d91ef31d30a","name":"BugBounty_OBB.postman_collection.json","filename":"BugBounty_OBB.postman_collection.json","description":null,"icon":"fileOther","size":20420,"sizeLabel":"19.9 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/254c76f8-2d66-4582-889e-5d91ef31d30a"},{"id":"ce9c748f-6c5e-4405-b7ca-a71174482416","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/ce9c748f-6c5e-4405-b7ca-a71174482416","name":"Environment%2520Placeholder.postman_environment%20(2).json","filename":"Environment%2520Placeholder.postman_environment%20(2).json","description":null,"icon":"fileOther","size":1193,"sizeLabel":"1.17 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/ce9c748f-6c5e-4405-b7ca-a71174482416"},{"id":"4ba0589c-bf01-4fef-9919-949b182bfe71","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/4ba0589c-bf01-4fef-9919-949b182bfe71","name":"BBTestUser-production.p12","filename":"BBTestUser-production.p12","description":null,"icon":"fileOther","size":2396,"sizeLabel":"2.34 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/4ba0589c-bf01-4fef-9919-949b182bfe71"},{"id":"8439b404-d8af-476d-a611-c69cfea74b7b","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/8439b404-d8af-476d-a611-c69cfea74b7b","name":"Connect%2520(Bug%2520Bounty%2520Test).postman_collection%20(2).json","filename":"Connect%2520(Bug%2520Bounty%2520Test).postman_collection%20(2).json","description":null,"icon":"fileOther","size":9509,"sizeLabel":"9.29 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/8439b404-d8af-476d-a611-c69cfea74b7b"},{"id":"164ae7e7-d587-4fe1-8ca6-a7db41fc021e","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/164ae7e7-d587-4fe1-8ca6-a7db41fc021e","name":"Insomnia_2023-01-11.json","filename":"Insomnia_2023-01-11.json","description":null,"icon":"fileOther","size":52627,"sizeLabel":"51.4 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/164ae7e7-d587-4fe1-8ca6-a7db41fc021e"},{"id":"94540526-d3a2-4a47-b8f5-8599540ab1fe","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/94540526-d3a2-4a47-b8f5-8599540ab1fe","name":"MDES%2520In-scope.txt","filename":"MDES%2520In-scope.txt","description":null,"icon":"fileOther","size":417,"sizeLabel":"417 Bytes","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/94540526-d3a2-4a47-b8f5-8599540ab1fe"},{"id":"c9d1085c-b997-45a3-a903-5f1da0bb5b72","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/c9d1085c-b997-45a3-a903-5f1da0bb5b72","name":"Environment%2520Variable.postman_environment.json","filename":"Environment%2520Variable.postman_environment.json","description":null,"icon":"fileOther","size":1334,"sizeLabel":"1.3 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/c9d1085c-b997-45a3-a903-5f1da0bb5b72"},{"id":"3259b25b-d9e6-4e4c-b8ad-d21b6dabeca0","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/3259b25b-d9e6-4e4c-b8ad-d21b6dabeca0","name":"Connect%2520Bug%2520Bounty%2520Guide.pdf","filename":"Connect%2520Bug%2520Bounty%2520Guide.pdf","description":null,"icon":"fileOther","size":74449,"sizeLabel":"72.7 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/3259b25b-d9e6-4e4c-b8ad-d21b6dabeca0"},{"id":"2667b9aa-2382-4a10-8af0-1d5082052e97","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/2667b9aa-2382-4a10-8af0-1d5082052e97","name":"Connect%2520Bug%2520Bounty%2520Guide%20(2).pdf","filename":"Connect%2520Bug%2520Bounty%2520Guide%20(2).pdf","description":null,"icon":"fileOther","size":74449,"sizeLabel":"72.7 KB","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/2667b9aa-2382-4a10-8af0-1d5082052e97"},{"id":"e7224f09-b3f4-4f86-bc1b-6d50352057be","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/e7224f09-b3f4-4f86-bc1b-6d50352057be","name":"Steps.txt","filename":"Steps.txt","description":null,"icon":"fileOther","size":401,"sizeLabel":"401 Bytes","uploadedAt":"27 Aug 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/e7224f09-b3f4-4f86-bc1b-6d50352057be"},{"id":"dcccee68-66f4-4b86-8c48-d20cbb0d73c4","attachmentPath":"https://bugcrowd.com/engagements/mastercard/attachments/dcccee68-66f4-4b86-8c48-d20cbb0d73c4","name":"Finicity_PaymentHistory_postman_collection.zip","filename":"Finicity_PaymentHistory_postman_collection.zip","description":null,"icon":"fileOther","size":1643,"sizeLabel":"1.6 KB","uploadedAt":"27 Aug 2024","fileType":"ZIP","embedUrl":"https://bugcrowd.com/engagements/mastercard/attachments/dcccee68-66f4-4b86-8c48-d20cbb0d73c4"}],"engagement":{"id":"e92dd756-2d4f-4be6-9dbd-d5159f2b6a06","code":"mastercard","state":"in_progress","endsAt":null,"bountyId":"771345d0-9bd0-4a47-b28b-e4690417f931","startsAt":"2016-08-01T21:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/b4a9/84bb/3dce2d73/b0f1f87e4b18bed77f9242b568d5f365_FINAL_-_Works_for_brief.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2016-08-01T21:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/mastercard","changelogs":"/engagements/mastercard/changelog","submissions":null,"announcements":"/engagements/mastercard/announcements","hallOfFame":"/engagements/mastercard/hall_of_fames","crowdstream":"/engagements/mastercard/crowdstream"},"announcementsCount":20,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/mastercard/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=mastercard\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/mastercard/engagement_subscribers","engagementChangelogsUrl":"/engagements/mastercard/changelog","publishedAt":"2026-01-15T13:57:14.691Z","engagementChangelogUrl":"/engagements/mastercard/changelog/0eb3c506-d8ac-41ee-b469-3e0c2778dd1b","createUserFeedbacksUrl":"/engagements/mastercard/feedbacks","engagementCrowdstreamUrl":"/engagements/mastercard/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}