{"id":"86959e61-5387-49f8-b326-483b3a91aa9d","engagementId":"621fdd78-188c-4808-a7ed-dfda2a492de5","data":{"brief":{"id":"3b3fcac2-4b00-4a1b-863d-00b17700614d","name":"Moneytree KK","tagline":"Your Lifetime Financial Record","description":"\u003cp\u003e\u003ca href=\"https://moneytree.jp/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eMoneytree\u003c/a\u003e provides a personal finance management app that uses data aggregation to radically simplify your relationship with money. The service currently supports Japanese financial institutions and provides a Japanese \u0026amp; English language interface.\u003c/p\u003e\n\n\u003cp\u003eThis program adheres to the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for the prioritization/rating of findings.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eNEW UPDATES TO OUT OF SCOPE TESTING ITEMS, PLEASE ADVISE\u003c/em\u003e\u003c/p\u003e","industryTagId":null,"targetsOverview":"\u003cp\u003e\u003cem\u003eAny domain/property of Moneytree KK not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eFor this program, we're inviting researchers test our \u003cstrong\u003estaging\u003c/strong\u003e platform, divided in:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eDevices: (a) ios and (b) android applications\u003cbr\u003e\n(a) \u003ca href=\"https://itunes.apple.com/au/app/id586847189\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://itunes.apple.com/au/app/id586847189\u003c/a\u003e (Production. Read note below!)\u003cbr\u003e\n(b) \u003ca href=\"https://play.google.com/store/apps/details?id=jp.moneytree.moneytree\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://play.google.com/store/apps/details?id=jp.moneytree.moneytree\u003c/a\u003e (Production .apk Read note below!)\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWebclients: (a) general, (b) partners, (c) mobile and (d) oauth\u003cbr\u003e\n(a) \u003ca href=\"https://app-staging.getmoneytree.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://app-staging.getmoneytree.com\u003c/a\u003e\u003cbr\u003e\n(b) \u003ca href=\"https://wwws-staging.moneytree.jp/link/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://wwws-staging.moneytree.jp/link/\u003c/a\u003e\u003cbr\u003e\n(c) \u003ca href=\"https://wwws-staging.moneytree.jp/link/mobile/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://wwws-staging.moneytree.jp/link/mobile/\u003c/a\u003e\u003cbr\u003e\n(d) \u003ca href=\"https://wwws-staging.moneytree.jp/link/mobile/#/signup?client_id=38..\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://wwws-staging.moneytree.jp/link/mobile/#/signup?client_id=38..\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eRegional API: (a) our main monolithic API (internally connects to several services)\u003cbr\u003e\n(a) \u003ca href=\"https://jp-api-staging.getmoneytree.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://jp-api-staging.getmoneytree.com\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eGuest Service: OAuth\u003cbr\u003e\n(a) \u003ca href=\"https://myaccount-staging.getmoneytree.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://myaccount-staging.getmoneytree.com\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eiOS is not friendly for hosting staging versions, so we shared the production link. However, while we allow the use of it to understand the navigation flow, please avoid pentesting against any domain that does not contain \u003cstrong\u003estaging\u003c/strong\u003e.\u003c/p\u003e\n\n\u003ch3\u003eAccess\u003c/h3\u003e\n\n\u003cp\u003eThere are no restrictions, but some rate-limits may apply.\u003c/p\u003e\n\n\u003ch3\u003eCredentials\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eRegister your free accounts with your \u003ccode\u003e@bugcrowdninja email\u003c/code\u003e. \u003c/li\u003e\n\u003cli\u003eYou're free to upgrade your account with a Stripe testing account. Ex: \u003ccode\u003e4242424242424242\u003c/code\u003e (any expiration date)\u003c/li\u003e\n\u003cli\u003eUse the \u003ccode\u003eclient_id\u003c/code\u003e provided in the scope URL to test any OAuth flow.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003ccode\u003eTest Institutions\u003c/code\u003e can be used to simulate linking banks, credit card, or point accounts. To get to the test financial institution, when adding an account, select 'bank', and then 'test financial institution' - which will provide you with the options for a test bank/credit card/etc. Other test institutions can be used to simulate error states.\u003c/p\u003e\n\n\u003ch3\u003e500 Internal Errors\u003c/h3\u003e\n\n\u003cp\u003eIf you provoke any 500, we are going to receive an alert and fix it as soon as possible. Please, do not continue fuzzing after finding one of these.\u003c/p\u003e\n\n\u003ch3\u003eNote:\u003c/h3\u003e\n\n\u003cp\u003eResearchers must provide a fully working non-malicious proof of concept that demonstrates a valid security impact in order to qualify for rewards.\u003c/p\u003e\n\n\u003ch3\u003eOut-of-Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eNo DMARC, nor SPF\u2028\u003c/li\u003e\n\u003cli\u003eCLIENT_ID is public. However, there are other keys that are valid testing but please note this.\n\u2028- Android App has the “allowBackup” attribute enabled (and others) specifically just for testing.\n\u2028- Do not register with another email than the Bugcrowd official one\u2028\u003c/li\u003e\n\u003cli\u003eVulnerabilities that requires to physically access the mobile device and unblock it\n\u2028- Any Intercom related issues\u003c/li\u003e\n\u003cli\u003eRecommendations, best practices or anything without a proof of concept\u003c/li\u003e\n\u003cli\u003eCopy \u0026amp; pasted reports containing links from other customers\u003c/li\u003e\n\u003cli\u003eOAuth session token is not invalidated on logout or password change/reset\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003eDelete account\u003c/code\u003e nor \u003ccode\u003echange password\u003c/code\u003e nor \u003ccode\u003echange email\u003c/code\u003e don't ask for old password\u003c/li\u003e\n\u003cli\u003eServer Security Misconfiguration | No Rate Limiting on Form | Login [as of 9:30 PM PT on 1/25/2018]\u003c/li\u003e\n\u003cli\u003eServer Security Misconfiguration | No Rate Limiting on Form | Registration [as of 9:30 PM PT on 1/25/2018]\u003c/li\u003e\n\u003cli\u003eServer Security Misconfiguration | No Rate Limiting on Form | Email-Triggering [as of 9:30 PM PT on 1/25/2018]\u003c/li\u003e\n\u003cli\u003e(NEW!) Anything related to \"Moneytree Business\" bypass trial or subscription override is a known issue \u003c/li\u003e\n\u003cli\u003e(NEW!) Free guests have historical data restrictions, but we are aware it can be bypassed by querying the API or using the web version.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eReport any data leak\u003c/h3\u003e\n\n\u003cp\u003eWe will immensely appreciate that you report all the information you reveal. Our customers deserve to be notified if their private information was shown without their consent. Please make all reports confidentially via the Bugcrowd platform.\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"98814c5b-3303-4bee-85ce-d10f28b81fc1","name":"Staging @ moneytree.jp","targets":[{"id":"0be193a1-a6d9-44c9-998f-b9017d01ab80","uri":"https://wwws-staging.moneytree.jp/link/","name":"Moneytree Web for Web","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"830930cb-3ef6-4628-93cd-72a5c58cbf15","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0be193a1-a6d9-44c9-998f-b9017d01ab80"}],"recentChangeFlags":null},{"id":"a321766a-6cba-4e2a-8dfe-4d56d05ae93b","uri":"https://vault-staging.getmoneytree.com","name":"Moneytree Universal Vault","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"692ea9cf-ae3b-4375-9a7e-4a93423d0b72","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a321766a-6cba-4e2a-8dfe-4d56d05ae93b"}],"recentChangeFlags":null},{"id":"c63f9d2f-1ec3-4a65-adaf-90a49de81e09","uri":"https://redash-staging.getmoneytree.com/","name":"Moneytree Internal Redash","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cfcb1d9a-e45b-4097-be01-68b949b50084","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c63f9d2f-1ec3-4a65-adaf-90a49de81e09"}],"recentChangeFlags":null},{"id":"61d67f44-f12b-4c8e-848d-261970605166","uri":"https://app-staging.getmoneytree.com","name":"https://app-staging.getmoneytree.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a04b5ea2-490a-4c27-9642-937c0a3cfd1d","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"61d67f44-f12b-4c8e-848d-261970605166"}],"recentChangeFlags":null},{"id":"bef59325-7837-49b0-9004-85d25787d468","uri":"https://wwws-staging.moneytree.jp/link/mobile/","name":"Moneytree Web for Mobile","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"48709bfe-fe9e-4916-92c5-7ef8932f0dc3","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bef59325-7837-49b0-9004-85d25787d468"}],"recentChangeFlags":null},{"id":"e64d1577-f941-4b98-b28f-fa0f2c98c26e","uri":"https://wwws-staging.moneytree.jp/link/mobile/#/signup?client_id=38d99a6e8e9fc87c866f5aa82bdc2569c464b2323a55e0b28f658efa678e9623\u0026redirect_uri=https://wwws-staging.moneytree.jp/link/mobile/callback\u0026response_type=token\u0026scope=guest_read+accounts_read+transactions_read+request_refresh","name":"Moneytree Web for Mobile (with Oauth)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8b7a5881-447e-4d0e-85dc-6ef8af5c2523","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e64d1577-f941-4b98-b28f-fa0f2c98c26e"}],"recentChangeFlags":null},{"id":"dbcbec0c-62e2-474b-9273-78c4dd6d1727","uri":"https://myaccount-staging.getmoneytree.com","name":"Moneytree MyAccount","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3c29d1c6-c0e3-4eca-bab6-6d7d92263a13","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"dbcbec0c-62e2-474b-9273-78c4dd6d1727"}],"recentChangeFlags":null},{"id":"ee192e6e-a405-46f0-be23-a986422a091a","uri":"https://business-staging.getmoneytree.com/","name":"Moneytree Business","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ffecb546-6950-4723-9dad-3cf908803dbf","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ee192e6e-a405-46f0-be23-a986422a091a"}],"recentChangeFlags":null},{"id":"df5abcab-2fee-409c-b22e-da0e6d31d056","uri":"https://jp-api-staging.getmoneytree.com","name":"Moneytree API","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e4814fe7-6b76-4981-871a-6f5ba344047b","sortOrder":8},"sortOrder":8,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"df5abcab-2fee-409c-b22e-da0e6d31d056"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"df5abcab-2fee-409c-b22e-da0e6d31d056"}],"recentChangeFlags":null},{"id":"580fd2cf-ee08-457f-968f-b9a1e74faa56","uri":"https://play.google.com/store/apps/details?id=jp.moneytree.moneytree\u0026hl=en_AU\u0026gl=US","name":"Moneytree Android Mobile Application (staging; see below)","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1071d132-9eac-465f-b2ff-c7b852eb6ab7","sortOrder":9},"sortOrder":9,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"580fd2cf-ee08-457f-968f-b9a1e74faa56"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"580fd2cf-ee08-457f-968f-b9a1e74faa56"}],"recentChangeFlags":null},{"id":"4e1419e4-2fa3-45dd-b369-b5613d5eef99","uri":"https://apps.apple.com/vc/app/moneytree-finance-made-easy/id586847189","name":"Moneytree iOS Mobile Application (production; see below)","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"737a1af3-e5ea-4148-8bac-31e6108246ad","sortOrder":10},"sortOrder":10,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"4e1419e4-2fa3-45dd-b369-b5613d5eef99"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"4e1419e4-2fa3-45dd-b369-b5613d5eef99"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"e7cccfb5-c38d-4c9f-a456-6f95d3ea25dc","p1MaxCents":500000,"p1MinCents":400000,"p2MaxCents":300000,"p2MinCents":200000,"p3MaxCents":100000,"p3MinCents":75000,"p4MaxCents":50000,"p4MinCents":30000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eAll domains related to \u003cstrong\u003eMoneytree K.K.\u003c/strong\u003e on \u003cstrong\u003estaging\u003c/strong\u003e, including our web, android, and iOS applications.\u003c/p\u003e","rewardRangeData":{"1":{"min":4000,"max":5000},"2":{"min":2000,"max":3000},"3":{"min":750,"max":1000},"4":{"min":300,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"b23db6cc-42a0-4146-92a7-436804523f88","name":"Out of scope","targets":[{"id":"e0d6f028-dace-4f7e-810a-933141db46c9","uri":null,"name":"moneytree.jp","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f8128e74-fbfe-4d57-be8b-7ec765cc8955","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e0d6f028-dace-4f7e-810a-933141db46c9"}],"recentChangeFlags":null},{"id":"afc0eba6-5f59-4bc7-afe1-c2c5ae504b8c","uri":null,"name":"Any production asset of Moneytree KK (excepting the iOS app)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"78fbf151-5430-42ab-9c33-98f242f9ec7c","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"afc0eba6-5f59-4bc7-afe1-c2c5ae504b8c"}],"recentChangeFlags":null},{"id":"e867d505-8a08-45db-8cfc-56bab960f207","uri":null,"name":"getmoneytree.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b1416d14-0843-4513-85d0-af00b9f88aba","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e867d505-8a08-45db-8cfc-56bab960f207"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"621fdd78-188c-4808-a7ed-dfda2a492de5","code":"moneytreekkog","state":"in_progress","endsAt":null,"bountyId":"b420bc29-1ff4-4a6b-8dae-555291676d9e","startsAt":"2018-01-16T22:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":null,"methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/c891/9763/1f705e53/210983b0044133f8fc9f72107033767a_moneytree-logo.png","logoBackgroundColor":"#11C048","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2018-01-16T22:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/moneytreekkog","changelogs":"/engagements/moneytreekkog/changelog","submissions":null,"announcements":"/engagements/moneytreekkog/announcements","hallOfFame":"/engagements/moneytreekkog/hall_of_fames","crowdstream":"/engagements/moneytreekkog/crowdstream"},"announcementsCount":2,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/moneytreekkog/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=moneytreekkog\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/moneytreekkog/engagement_subscribers","engagementChangelogsUrl":"/engagements/moneytreekkog/changelog","publishedAt":"2025-03-18T09:27:34.957Z","engagementChangelogUrl":"/engagements/moneytreekkog/changelog/86959e61-5387-49f8-b326-483b3a91aa9d","createUserFeedbacksUrl":"/engagements/moneytreekkog/feedbacks","engagementCrowdstreamUrl":"/engagements/moneytreekkog/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}