{"id":"51bde1a9-f3e2-44b2-ba5b-55af984be7f2","engagementId":"d78f5dc5-e3b7-4f50-bf64-0e06864568c5","data":{"brief":{"id":"1c61df18-afc3-4aa9-84f7-e9badbfdc806","name":"MyFitnessPal Managed Bug Bounty","tagline":"Nutrition tracking for real life","description":"\u003cp\u003eMyFitnessPal is the #1 nutrition and food tracking app. We believe in community support and sharing techniques and successes! The security community is integral to helping keep our products and services safe for the users. This brief outlines steps for reporting vulnerabilities to us, what we expect, and what you can expect from us. We look forward to working with the security community to find security vulnerabilities in order to keep our business and customers safe.\u003c/p\u003e\n\n\u003ch1\u003eProgram Rules\u003c/h1\u003e\n\n\u003ch2\u003ePlease read our entire policy page before you begin!\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003e\u003cstrong\u003eIMPORTANT NOTE: \u003ca href=\"https://community.myfitnesspal.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCOMMUNITY.MYFITNESSPAL.COM\u003c/a\u003e  IS OUT OF SCOPE. The community forums are OUT OF SCOPE for this bug bounty program. Any posts, interactions, or other activities made in our community forums for the purpose of bug bounty testing are strictly prohibited. ANY TESTING OR REPORTS AGAINST COMMUNITY.MYFITNESSPAL.COM WILL RESULT IN PERMANENT REMOVAL FROM THIS PROGRAM.\u003c/strong\u003e\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003cstrong\u003eAll authenticated activity on our platform must be conducted using a MyFitnessPal account linked to a @bugcrowdninja.com email address.\u003c/strong\u003e Any activity as part of this engagement with MyFitnessPal linked to a non-Bugcrowd email address is strictly prohibited.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ePlease provide detailed reports with reproducible steps and a PoC. If the report is not detailed enough with how the vulnerability can be leveraged, and how to reproduce the issue, the issue will not be eligible for a reward.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWhen duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eSubmit one vulnerability per report, unless you need to chain vulnerabilities to illustrate impact.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eMultiple attack paths that target the same underlying vulnerability will be awarded one bounty.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAvoid in any way damaging, disabling, overburdening, impairing, interrupting, degrading, or impeding the normal use of our services.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDo not delete or destroy any data.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eRefrain from any activities that are prohibited, that violate applicable laws (including privacy laws), or that are harmful to the rights and interests of others.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIf you encounter user information or any other personally identifiable information (e.g., names, device identifiers, etc.) during your testing please stop immediately and notify us through Bugcrowd. This information is and shall remain confidential. Further guidance will be provided along with an appropriate bounty for your finding.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ePlease refrain from automated scanning against the domain.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDo not engage in extortion.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDo not leave any system in a more vulnerable state than you found it.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDo not brute force user credentials or test credentials from public data disclosures.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eSocial engineering attacks (e.g. spear phishing) are prohibited.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eOnly interact with MyFitnessPal accounts you own.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch1\u003eConfidentiality\u003c/h1\u003e\n\n\u003cp\u003eBy participating in this program you agree to keep any information you access or receive about MyFitnessPal (e.g., about MyFitnessPal systems, vulnerabilities, and the reports you submit) strictly confidential in accordance with the Standard Disclosure Terms and agree not to share such information with any third parties.\u003c/p\u003e\n\n\u003ch1\u003eSubmission Requirements\u003c/h1\u003e\n\n\u003col\u003e\n\u003cli\u003e\u003cp\u003eSummary of the bug\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eSteps to reproduce\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWorking proof of concept\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eImpact is based on, but not limited to the following:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eHow complex is the demonstrated exploit?\u003c/li\u003e\n\u003cli\u003eHow likely is it that this vulnerability could be exploited? Would an attacker economically benefit from exploitation?\u003c/li\u003e\n\u003cli\u003eHow many users can the exploit target at once?\u003c/li\u003e\n\u003cli\u003eIs any private user data exposed?\u003c/li\u003e\n\u003cli\u003eIs any confidential company data exposed?\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ol\u003e","industryTagId":"50214b57-2dde-40fd-ae5a-6680372523d4","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of MyFitnessPal not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not explicitly out of scope, but it demonstrably belongs to MyFitnessPal, you can report it to this program. However, be aware that it may only be awarded on a case-by-case basis.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eAll targets are publicly accessible and the applications can be downloaded from the iOS and Android app store\u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for a MyFitnessPal account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. A one month upgrade to Premium or Premium+ can be granted upon request when needed for security testing, otherwise no credentials will be provided for this program. Please email \u003ca href=\"mailto:support@myfitnesspal.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esupport@myfitnesspal.com\u003c/a\u003e with the subject line “Upgrade Request for Bugcrowd” and provide your MyFitnessPal account(s) email and MyFitnessPal username. Temporary upgrades will only be provided to MyFitnessPal accounts created with @bugcrowdninja.com email addresses. Use account credentials that you are ready to share with the MyFitnessPal security team via Bugcrowd, so we can access the account during investigations if needed.\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003col\u003e\n\u003cli\u003e\u003cp\u003eApplication testing \u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWebsite testing \u003c/p\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eThe following is a partial list of issues that we ask for you not to report:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eDoS / DDoS involving high request volumes\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eRate-limiting issues\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ePublic Zero-day vulnerabilities that have had an official patch for less than 1 month may be awarded on a case by case basis\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eReports of accounts that may have been compromised in the 2018 Under Armour/MyFitnessPal breach, including new large collections of accounts from collated breaches, are not in scope for this bug bounty program. For questions or concerns related to this event, please reach out to our support site or \u003ca href=\"mailto:support@MyFitnessPal.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esupport@MyFitnessPal.com\u003c/a\u003e\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eInformational\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eCross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eUnauthenticated/logout/login CSRF\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAttacks requiring MITM or physical access to a user's device\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eOpen redirect - unless an additional security impact can be demonstrated\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eVulnerabilities only affecting users of outdated or unpatched browsers [Greater than 2 stable versions behind the latest released stable version]\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eClickjacking and issues only exploitable through clickjacking\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIssues that require unlikely user interaction\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eSpecific to Android\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e  Any URIs leaked because a malicious app has permission to view URIs opened\u003c/li\u003e\n\u003cli\u003e  Sensitive data in URLs/request bodies when protected by TLS\u003c/li\u003e\n\u003cli\u003e  User data stored unencrypted on external storage.\u003c/li\u003e\n\u003cli\u003e  Any kind of sensitive data stored in app private directory\u003c/li\u003e\n\u003cli\u003e  Dynamic code loading\u003c/li\u003e\n\u003cli\u003e  Runtime hacking exploits (exploits only possible in a jailbroken environment)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eSpecific to iOS\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e  Path disclosure in the binary\u003c/li\u003e\n\u003cli\u003e  User data stored unencrypted on the file system\u003c/li\u003e\n\u003cli\u003e  Oauth \"app secret\" hard-coded/recoverable.\u003c/li\u003e\n\u003cli\u003e  Runtime hacking exploits (exploits only possible in a jailbroken environment).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research conducted under this policy to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eAuthorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAuthorized in accordance with any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eExempt from restrictions in our Terms \u0026amp; Conditions of Use that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further. This safe harbor only applies to research conducted in accordance with this policy and only for targets listed as in scope (as specified in this policy).\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"cf093180-2958-4af6-9b4c-248c565a7be0","name":"Out of Scope","targets":[{"id":"d54d25a0-0737-49a6-bf10-e0e66ed822d1","uri":"https://community.myfitnesspal.com","name":"community.myfitnesspal.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"69eebcef-4589-4c9d-8326-4a30adc5f977","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d54d25a0-0737-49a6-bf10-e0e66ed822d1"}],"recentChangeFlags":null},{"id":"d7a488ad-7d0c-4a1c-85cc-8d00b93c1b96","uri":"https://community-stage.myfitnesspal.com","name":"community-stage.myfitnesspal.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fb7f4448-7145-41da-b3bd-9d80d3c0ccc6","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d7a488ad-7d0c-4a1c-85cc-8d00b93c1b96"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003e\u003cstrong\u003eThese targets are explicitly OUT OF SCOPE. ANY testing to these targets will result in IMMEDIATE AND PERMANENT REMOVAL FROM THE PROGRAM.\u003c/strong\u003e\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"566b5534-5408-42ac-9207-782b6adb5a8c","name":"Mobile application (High priority targets)","targets":[{"id":"e8752360-3cba-4a1e-8f92-e379fe23168c","uri":"https://market.android.com/details?id=com.myfitnesspal.android\u0026rdid=com.myfitnesspal.android","name":"com.myfitnesspal.android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b2bf2fe3-33cf-4506-aa76-d48f7d039a1b","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"e8752360-3cba-4a1e-8f92-e379fe23168c"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"e8752360-3cba-4a1e-8f92-e379fe23168c"}],"recentChangeFlags":null},{"id":"d8a52c8a-09e4-4d07-9d1a-13a1e6142800","uri":"https://apps.apple.com/us/app/myfitnesspal-calorie-counter/id341232718","name":"iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"100b5d1d-5662-4398-a9db-ac969208a15c","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"d8a52c8a-09e4-4d07-9d1a-13a1e6142800"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"d8a52c8a-09e4-4d07-9d1a-13a1e6142800"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"b2537c90-0192-4563-926a-26486f24f7bd","p1MaxCents":450000,"p1MinCents":350000,"p2MaxCents":250000,"p2MinCents":150000,"p3MaxCents":30000,"p3MinCents":20000,"p4MaxCents":5000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":3500,"max":4500},"2":{"min":1500,"max":2500},"3":{"min":200,"max":300},"4":{"min":50,"max":50},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"27be79b6-8f49-4728-b894-02f16fc8a125","name":"In Scope Targets (Regular)","targets":[{"id":"ab25fb33-0365-4da1-98b9-9d589cd48e59","uri":"","name":"*.myfitnesspal.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5a67494d-93ed-41bf-bcac-0dba739b9d84","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"ab25fb33-0365-4da1-98b9-9d589cd48e59"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"ab25fb33-0365-4da1-98b9-9d589cd48e59"},{"id":"5a702681-f59c-463c-b266-f9e22a1e1d8a","name":"Scala","targetId":"ab25fb33-0365-4da1-98b9-9d589cd48e59"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"ab25fb33-0365-4da1-98b9-9d589cd48e59"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"207bd7f1-26c9-4b48-a2c8-77bcf16e14d5","p1MaxCents":450000,"p1MinCents":350000,"p2MaxCents":250000,"p2MinCents":150000,"p3MaxCents":30000,"p3MinCents":5000,"p4MaxCents":5000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":3500,"max":4500},"2":{"min":1500,"max":2500},"3":{"min":50,"max":300},"4":{"min":50,"max":50},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"d78f5dc5-e3b7-4f50-bf64-0e06864568c5","code":"myfitnesspal-mbb","state":"in_progress","endsAt":null,"bountyId":"af58eeb5-b0cd-4d24-8d4a-a2d0b06931dc","startsAt":"2022-03-31T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Healthcare","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/67fc/3e8c/a557be05/aae1c7b7f497278471f5594337a76398_MyFitnessPal-MBB.jpeg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2022-03-31T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/myfitnesspal-mbb","changelogs":"/engagements/myfitnesspal-mbb/changelog","submissions":null,"announcements":"/engagements/myfitnesspal-mbb/announcements","hallOfFame":"/engagements/myfitnesspal-mbb/hall_of_fames","crowdstream":"/engagements/myfitnesspal-mbb/crowdstream"},"announcementsCount":6,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/myfitnesspal-mbb/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=myfitnesspal-mbb\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/myfitnesspal-mbb/engagement_subscribers","engagementChangelogsUrl":"/engagements/myfitnesspal-mbb/changelog","publishedAt":"2025-09-24T19:40:03.554Z","engagementChangelogUrl":"/engagements/myfitnesspal-mbb/changelog/51bde1a9-f3e2-44b2-ba5b-55af984be7f2","createUserFeedbacksUrl":"/engagements/myfitnesspal-mbb/feedbacks","engagementCrowdstreamUrl":"/engagements/myfitnesspal-mbb/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}