{"id":"b022dbc5-a166-483d-adae-2b7d6cf9aa79","engagementId":"50e6074e-282e-40ca-b9b4-0134001512df","data":{"brief":{"id":"df0e344b-240b-4afe-98ad-482882cefdd7","name":"National Football League (NFL) Vulnerability Disclosure Engagement","tagline":"The NFL, founded in 1920, is America's most popular sports league with 32 franchises competing for the Super Bowl. Headquartered in New York, it has global offices.","description":"\u003cp\u003eThe National Football League is America's most popular sports league, comprised of 32 franchises that compete each year to win the Super Bowl, the world's biggest annual sporting event. Founded in 1920, the NFL developed the model for the successful modern sports league, including national and international distribution, extensive revenue sharing, competitive excellence, and strong franchises across the board. The NFL is the industry leader on a wide range of fronts.\u003c/p\u003e\n\n\u003cp\u003eHeadquartered in New York City, the NFL expands across the nation and the globe with the offices including the NFL West office based in Inglewood, CA, the NFL Films office based in Mt. Laurel, NJ. The NFL also has satellite offices in Atlanta, Washington DC, and Chicago. Our International offices are located in the UK, Germany, China, Mexico \u0026amp; Canada.\u003c/p\u003e\n\n\u003cp\u003eGood luck and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"0def401b-0941-4302-b6d6-5f49469b8ca5","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of the NFL not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before submitting.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess/Credentials\u003c/h2\u003e\n\n\u003cp\u003eAccounts that require credentials on all publicly facing targets are self-signup. Please your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny and all NFL team websites \u003c/li\u003e\n\u003cli\u003e3rd party assets (e.g., https://*.rams.com)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support \u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"fde84c7a-a74e-490d-86ed-154a5404a379","name":"In Scope","targets":[{"id":"fa744c32-ade9-4389-94f3-e1e13d6f0848","uri":"","name":"https://*.nfl.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"76461828-4850-4101-8057-8857c714ee53","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"fa744c32-ade9-4389-94f3-e1e13d6f0848"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fa744c32-ade9-4389-94f3-e1e13d6f0848"}],"recentChangeFlags":null},{"id":"d27fefcc-0f85-4867-aa5e-bea86f7a2123","uri":"https://apps.apple.com/us/app/nfl/id389781154","name":"NFL iOS Mobile App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6a0b7c6a-9dae-4c73-9c4c-0b499c741225","sortOrder":1},"sortOrder":1,"tags":[{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"d27fefcc-0f85-4867-aa5e-bea86f7a2123"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"d27fefcc-0f85-4867-aa5e-bea86f7a2123"}],"recentChangeFlags":null},{"id":"df81bcbd-a011-4461-ac0e-91ee7d3e6c65","uri":"https://apps.apple.com/us/app/nfl-onepass/id1456010454","name":"NFL OnePass Mobile App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1dbaf23f-92d3-4cfa-bd16-b3ddfd41f60f","sortOrder":2},"sortOrder":2,"tags":[{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"df81bcbd-a011-4461-ac0e-91ee7d3e6c65"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"df81bcbd-a011-4461-ac0e-91ee7d3e6c65"}],"recentChangeFlags":null},{"id":"2258ae8a-130b-4bc3-afb1-d8e9c5f1931e","uri":"https://apps.apple.com/us/app/nfl-events/id1494588053","name":"NFL Events Mobile App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8bda7e66-0351-49a3-8f6f-bedb473f2d04","sortOrder":3},"sortOrder":3,"tags":[{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"2258ae8a-130b-4bc3-afb1-d8e9c5f1931e"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"2258ae8a-130b-4bc3-afb1-d8e9c5f1931e"}],"recentChangeFlags":null},{"id":"d4e5ccb7-a1d2-4f70-a359-bb1389d9a81b","uri":"https://play.google.com/store/search?q=nfl\u0026c=apps\u0026hl=en_US","name":"NFL Andriod Mobile App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2fb17820-c4ca-4ec9-b33d-ac769db5864f","sortOrder":4},"sortOrder":4,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"d4e5ccb7-a1d2-4f70-a359-bb1389d9a81b"}],"recentChangeFlags":null},{"id":"3333f370-a453-4396-b364-19a6025c882d","uri":"","name":"Any host verified to be owned by NFL Enterprises LLC","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3d12c7fb-a9db-4ebf-8b77-256de28ad4fb","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3333f370-a453-4396-b364-19a6025c882d"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eTargets are a defined list of externally-facing NFL assets including nfl.com as an example. It is page where fans and the like can engage in NFL content for updates and news.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"50e6074e-282e-40ca-b9b4-0134001512df","code":"nfl-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"7bb8c46a-4735-4dc8-b7fd-2a73a5c01a9f","startsAt":"2024-07-02T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Media","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/dc8e/976c/23d576ba/cbf9d3c4e7dc5a974e27565bad46ae76_national_football_league_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-07-02T18:00:00.285Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/nfl-vdp-pro","changelogs":"/engagements/nfl-vdp-pro/changelog","submissions":null,"announcements":"/engagements/nfl-vdp-pro/announcements","hallOfFame":"/engagements/nfl-vdp-pro/hall_of_fames","crowdstream":"/engagements/nfl-vdp-pro/crowdstream"},"announcementsCount":2,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/nfl-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=nfl-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/nfl-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/nfl-vdp-pro/changelog","publishedAt":"2026-09-11T14:25:57.929Z","engagementChangelogUrl":"/engagements/nfl-vdp-pro/changelog/b022dbc5-a166-483d-adae-2b7d6cf9aa79","createUserFeedbacksUrl":"/engagements/nfl-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/nfl-vdp-pro/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}