{"id":"6bded391-eff8-479d-a41c-4efdcee70ed0","engagementId":"b6d1de9f-4839-4658-bf1b-2beac6740b1b","data":{"brief":{"id":"fc6e58f8-6980-4365-af9b-b23be25202cf","name":"Moovit Managed Bug Bounty Program","tagline":"Moovit is a leading Mobility as a Service (MaaS) solutions company and the #1 urban mobility app. Please submit your findings to this Bug Bounty Program.","description":"\u003cp\u003eWelcome to Moovit's Bug Bounty Program! We value the security and privacy of our users and are committed to maintaining a safe online environment. Please review our program guidelines and responsible disclosure policy for more details on how to report vulnerabilities, what's in scope, and the rules of engagement. Thank you for helping us maintain a secure environment for our users.\u003c/p\u003e\n\n\u003cp\u003eAs further elaborated below, we expect you to provide us with the full scope of information you come across when conducting your vulnerability research. Please try to minimize your access to personal information to the minimal extent possible.\u003c/p\u003e\n\n\u003cp\u003eMoovit is an innovative app that revolutionizes the way people navigate and use public transportation, allowing commuters to plan their journeys seamlessly. With real-time data, accurate schedules, and detailed routes, Moovit provides reliable information on buses, trains, metros, trams, and other public transportation options available in over 3,200 cities worldwide.\u003c/p\u003e\n\n\u003cp\u003eThe key asset of Moovit is its user community, which actively contributes to the app's accuracy and richness of information. Users can report real-time updates, such as crowdedness, delays, or any disruptions in transit services, enabling fellow travelers to make informed decisions and avoid unnecessary delays.\u003c/p\u003e\n\n\u003cp\u003eMoovit also offers features that cater to the needs of individuals with specific accessibility requirements. It provides information on wheelchair accessibility, step-free routes, and live updates to ensure an inclusive and convenient transit experience for all users. Additional functionalities include integration with ride-sharing services and the ability to save favorite locations and routes for quick access. \u003c/p\u003e\n\n\u003cp\u003eOverall, Moovit revolutionizes public transportation by providing an efficient app that assists users in planning their journeys, accessing accurate real-time data, and contributing to the improvement of the transit experience. \u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"78192436-6ce2-4bc8-a809-e4a20c182519","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Moovit not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eMoovit’s iOS, Android, and Web app guides people in getting around town effectively and conveniently, using any mode of transport. Introduced in 2012 it now serves over 1.5 billion users in more than 3,500 cities across 112 countries.\u003c/p\u003e\n\n\u003cp\u003eMoovit amasses up to six billion anonymous data points a day to add to the world’s largest repository of transit and urban mobility data. For governments, cities, transit agencies, and private companies Moovit offers AI-powered MaaS solutions covering planning, operations, and optimization with proven value in reducing congestion, growing ridership, and increasing efficiency and asset utilization.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWayFinder (iPhone only)\u003c/strong\u003e\u003cbr\u003e\nThe way finder is a tool that helps users find their way to their stop or destination by using their camera\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eApps are accessible to public in Google and Apple app stores \u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eAccounts on the apps can be self-provisioned. Please sign up for an account using your program-dedicated @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthentication and Authorization\u003c/li\u003e\n\u003cli\u003eUnrestricted access to API \u003c/li\u003e\n\u003cli\u003ePrivacy and data protection issues\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eBug Bounty Program Rules and Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll issues must be reproducible\u003c/li\u003e\n\u003cli\u003eAll issues must demonstrate an actual impact\u003c/li\u003e\n\u003cli\u003eAutomated Testing such as scanners is not permitted\u003c/li\u003e\n\u003cli\u003eAll submission reports must follow the guidelines as shown below\u003c/li\u003e\n\u003cli\u003eDo not create endless accounts on the system, in case this is a must, please approach the security team.\u003c/li\u003e\n\u003cli\u003eDo not use attacks on physical security, social engineering, distributed denial of service (or any attack using large volumes of requests), spam or applications of third parties.\u003c/li\u003e\n\u003cli\u003ePlease avoid causing potential or actual damage. If you are uncertain, feel free to reach out to us before taking any action.\u003c/li\u003e\n\u003cli\u003eTesting is allowed with your own personal account only. Do not   engage with other accounts without the explicit permission of their owners.\u003c/li\u003e\n\u003cli\u003eDo provide all information to enable us to reproduce the problem and any other relevant information with respect to the vulnerability. \u003c/li\u003e\n\u003cli\u003eWe address issues by identifying their root cause or component. Therefore, if the same issue arises in the same component but in different locations, it will be treated as a duplicate\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAccording to the general policy \u003ca href=\"http://moovitapp.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003emoovitapp.com\u003c/a\u003e or any web apps are OOS\u003c/li\u003e\n\u003cli\u003eAccording to the general policy \u003ca href=\"http://moovitapp.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003emoovitapp.com\u003c/a\u003e every app not related to the Moovit mobile application is OOS\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eThe following bugs are unlikely to be eligible for a bounty:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eClickjacking\u003c/li\u003e\n\u003cli\u003eCSV Injection\u003c/li\u003e\n\u003cli\u003eSSL / TLS issues\u003c/li\u003e\n\u003cli\u003eBrute Force attacks\u003c/li\u003e\n\u003cli\u003eDenial of Service attacks\u003c/li\u003e\n\u003cli\u003eIssues found through automated testing\u003c/li\u003e\n\u003cli\u003e\"Scanner output\" or scanner-generated reports\u003c/li\u003e\n\u003cli\u003eVulnerabilities requiring physical access to the victim's unlocked device\u003c/li\u003e\n\u003cli\u003eSpam or Social Engineering techniques\u003c/li\u003e\n\u003cli\u003e\"Tab-Nabbing\" or other rel=\"noopener\" bugs without a severe impact\u003c/li\u003e\n\u003cli\u003eSecurity bugs in third-party applications or services unless requested specifically\u003c/li\u003e\n\u003cli\u003eIssues relating to Password Policy\u003c/li\u003e\n\u003cli\u003eFull-Path Disclosure on any property\u003c/li\u003e\n\u003cli\u003eInformation Disclosure\u003c/li\u003e\n\u003cli\u003eCSRF for non-authenticated sections \u003c/li\u003e\n\u003cli\u003eMissing or misconfigured security headers\u003c/li\u003e\n\u003cli\u003eVulnerabilities that require Man in the Middle (MiTM) attacks\u003c/li\u003e\n\u003cli\u003eSecurity bugs in Moovit.com - If you find a vulnerability in WordPress, please see WordPress bounty program for reporting details\u003c/li\u003e\n\u003cli\u003eMissing security best practice without any tangible impact\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eConfidentiality \u0026amp; Non-Disclosure Agreement (NDA)\u003c/h2\u003e\n\n\u003cp\u003eWe take the privacy and security of our users and data seriously. As a condition of participation, researchers are required to sign an NDA to protect the confidentiality of information shared with you during the course of your research. Any reports and submissions shared with Moovit contain confidential information belonging to Moovit. This implies that you are obligated to maintain the confidentiality of your report or findings, refraining from disclosing them to any third party unless Moovit has granted written approval for such disclosure in advance.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eDisclaimer:\u003c/h2\u003e\n\n\u003cp\u003eThis bug bounty program is subject to change at any time, and we reserve the right to modify or terminate the program as needed. Please refer to the program policy for additional details. Payment of any fees shall be subject to this policy, the program policy, and our sole discretion.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003eWe recognize the importance of responsible disclosure and will not initiate legal action against researchers who adhere to our responsible disclosure guidelines and this program rules. Your contributions to improving our security are greatly appreciated, and we are committed to working collaboratively to address any reported issues.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"6ebe622e-7964-45cc-871b-916ee8e8444e","name":"Limited Double Bounty Promotion | July 7th - July 22nd","targets":[{"id":"9a0b6d66-c255-4a81-9ab9-ffe5db4af28f","uri":"","name":"All In Scope Targets","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3180ca72-7d47-4ffe-a4ea-943997ec8475","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"49055949-0ce7-4fcc-a5ce-1a01b3037e9c","p1MaxCents":700000,"p1MinCents":400000,"p2MaxCents":400000,"p2MinCents":200000,"p3MaxCents":150000,"p3MinCents":50000,"p4MaxCents":50000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003e🚨 Double the Impact. Double the Rewards. 🚨\u003c/p\u003e\n\n\u003cp\u003eFrom \u003cstrong\u003eJuly 7th\u003c/strong\u003e to \u003cstrong\u003eJuly 22nd\u003c/strong\u003e, we’re turning up the heat with a Double Bounty Promotion across all in-scope assets! \u003cbr\u003e\nThat’s right, during this limited-time window, every valid submission will earn twice the payout. \u003c/p\u003e\n\n\u003cp\u003eThis is your opportunity to dig deep, explore those edge cases, and uncover the vulnerabilities others might have missed. \u003cbr\u003e\nEverything in the \u003cstrong\u003eIn Scope\u003c/strong\u003e target group is fair game, and every valid bug you land brings 2x the normal bounty straight to your account. (Meaning the bounty ranges on this group are the final payout amounts)\u003c/p\u003e\n\n\u003cp\u003eThe clock is ticking. The targets are waiting. Let the hunt begin and may the best bugs win big. \u003c/p\u003e","rewardRangeData":{"1":{"min":4000,"max":7000},"2":{"min":2000,"max":4000},"3":{"min":500,"max":1500},"4":{"min":200,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"1a91b962-4b93-494e-88f8-77748d229905","name":"In Scope","targets":[{"id":"ca1ece7f-d870-423f-b43a-c1b48a35d6dc","uri":"https://play.google.com/store/apps/details?id=com.tranzmate\u0026hl=en_US","name":"Moovit Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ff885f79-f6e6-4a01-8f21-753ec21f79fe","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"ca1ece7f-d870-423f-b43a-c1b48a35d6dc"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"ca1ece7f-d870-423f-b43a-c1b48a35d6dc"},{"id":"b6828a57-cf73-4668-827c-6006d8567d3b","name":"Firebase","targetId":"ca1ece7f-d870-423f-b43a-c1b48a35d6dc"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"ca1ece7f-d870-423f-b43a-c1b48a35d6dc"}],"recentChangeFlags":null},{"id":"9c08a936-56cb-4a35-8072-10361f75331e","uri":"https://apps.apple.com/us/app/moovit-all-transit-options/id498477945","name":"Moovit iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ed0ae46b-3771-4d29-bd85-51b70979f031","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"9c08a936-56cb-4a35-8072-10361f75331e"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"9c08a936-56cb-4a35-8072-10361f75331e"},{"id":"b6828a57-cf73-4668-827c-6006d8567d3b","name":"Firebase","targetId":"9c08a936-56cb-4a35-8072-10361f75331e"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"9c08a936-56cb-4a35-8072-10361f75331e"}],"recentChangeFlags":null},{"id":"78d19521-1b46-4dc4-8686-b7479336f7ef","uri":"https://support.moovitapp.com/hc/en-us/articles/11389054527122-WayFinder-Augmented-Reality-helper-to-find-your-stop-iPhone-only","name":"WayFinder - Augmented Reality helper to find your stop","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bf9c2cc4-bb9a-413a-9c3b-a657a490c67e","sortOrder":2},"sortOrder":2,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"78d19521-1b46-4dc4-8686-b7479336f7ef"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"78d19521-1b46-4dc4-8686-b7479336f7ef"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"78d19521-1b46-4dc4-8686-b7479336f7ef"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"44027c87-9af6-4e4a-8821-d523b60f134a","p1MaxCents":350000,"p1MinCents":200000,"p2MaxCents":200000,"p2MinCents":100000,"p3MaxCents":75000,"p3MinCents":25000,"p4MaxCents":25000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eTarget\u003c/h2\u003e\n\n\u003cp\u003eMoovit is a user-friendly public transportation app that helps you navigate cities with ease. It provides real-time information on buses, trains, and subways, offering route options, travel times, and updates on delays. The app\u0026#39;s intuitive interface and customizable features make it a go-to tool for a smooth and efficient commuting experience, whether in a familiar city or exploring a new one.\u003c/p\u003e","rewardRangeData":{"1":{"min":2000,"max":3500},"2":{"min":1000,"max":2000},"3":{"min":250,"max":750},"4":{"min":100,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"e90be008-1d7b-451f-8b6a-8e37435cbfc4","name":"Out Of Scope","targets":[{"id":"d3c329b0-e7c7-4cbb-8bc3-f49024e1fde6","uri":"","name":"Every Web App is Out Of Scope.","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"73e64e53-ff44-411b-91df-f258751f3dd7","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"cd3a9c0c-3343-40ba-a26e-689f7104d1b4","uri":"","name":"Every app not related to the Moovit mobile application.","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fd4c3715-b8ce-4487-b65d-d3e668750b71","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a11d86d4-9689-4241-89cf-b1f0c8b03568","uri":"","name":"Any WebView sources or web application rendered within the mobile applications","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f0b8a045-3b1c-42a8-90f9-e2add18773bb","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"b6d1de9f-4839-4658-bf1b-2beac6740b1b","code":"moovit-mbb-og","state":"in_progress","endsAt":null,"bountyId":"63e036e1-16c7-4af8-87fb-fcc2e5a1763e","startsAt":"2024-01-16T00:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Utilities","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/49ba/0d50/2a4e89d7/580df1f70018824f774c6f14dff1e55a_moovit_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-01-16T00:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/moovit-mbb-og","changelogs":"/engagements/moovit-mbb-og/changelog","submissions":null,"announcements":"/engagements/moovit-mbb-og/announcements","hallOfFame":"/engagements/moovit-mbb-og/hall_of_fames","crowdstream":"/engagements/moovit-mbb-og/crowdstream"},"announcementsCount":4,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/moovit-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=moovit-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/moovit-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/moovit-mbb-og/changelog","publishedAt":"2026-02-12T23:26:21.429Z","engagementChangelogUrl":"/engagements/moovit-mbb-og/changelog/6bded391-eff8-479d-a41c-4efdcee70ed0","createUserFeedbacksUrl":"/engagements/moovit-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/moovit-mbb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}