{"id":"023b04b9-26c1-48eb-8fe2-142a83ebc901","engagementId":"bc95f457-39ea-4bbc-80a6-f01f8f914ee7","data":{"brief":{"id":"1b0bdce2-e7f5-4c29-8532-5a9882f69f95","name":"Northwestern Mutual - Public Bug Bounty","tagline":"For 160 years, we've helped our clients achieve financial security by building lifelong relationships to help them create and carry out their financial plans. Spend Your Life Living","description":"\u003ch2\u003eWelcome!\u003c/h2\u003e\n\n\u003cp\u003eNorthwestern Mutual has been helping families and businesses achieve financial security for 160 years. Through a distinctive, whole-picture planning approach including both insurance and investments, we empower people to be financially confident. We combine the expertise of our financial professionals with a personalized digital experience and leading-edge technology to best serve our clients. Help us keep our digital experience secure.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRewards/Ratings:\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is \u003cem\u003eimportant\u003c/em\u003e to note that in some cases a vulnerability priority will be \u003cem\u003emodified\u003c/em\u003e due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eEligibility for Participation\u003c/h2\u003e\n\n\u003cp\u003eTo be eligible for the Northwestern Mutual Bug Bounty Program, you must:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eNot be in violation of any national, state, or local laws or regulation.\u003c/li\u003e\n\u003cli\u003eNot be an employee or spouse of an employee of the Northwestern Mutual Life Insurance Company or any of its affiliates or subsidiaries.\u003c/li\u003e\n\u003cli\u003eAgree to the more detailed legal information under \"Important Legal Terms\".\u003c/li\u003e\n\u003c/ul\u003e","industryTagId":"9fff4664-f609-49a9-a31f-be4e47e90ebf","targetsOverview":"","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":"\u003ch1\u003eImportant Legal Terms\u003c/h1\u003e\n\n\u003col\u003e\n\u003cli\u003e\u003cp\u003eThe parties to this Agreement are you and the Northwestern Mutual Life Insurance Company.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eBy participating in the Program, investigating a potential vulnerability, or submitting a vulnerability, you acknowledge that you have not disclosed and agree that you will not disclose the vulnerability to anyone other than the Northwestern Mutual Life Insurance Company. Any disclosure would violate this Agreement unless approved in writing by an authorized employee of the Northwestern Mutual Life Insurance Company responsible for cybersecurity threat detection and mitigation. You agree that money damages may not be a sufficient remedy for a breach of this paragraph by you and that the Northwestern Mutual Life Insurance Company will be entitled to specific performance as a remedy to this breach and an injunction without the posting of a bond. Such remedy will not be deemed to be the exclusive remedy for any such breach but will be in addition to all other remedies available at law or equity to the Northwestern Mutual Life Insurance Company.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eBy submitting information about a potential vulnerability, you are granting the Northwestern Mutual Life Insurance Company a worldwide, royalty-free, non-exclusive license to use your submission for the purpose of addressing vulnerabilities in products and services offered by the Northwestern Mutual Life Insurance Company.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIn the event of substantial duplicate submissions, the Northwestern Mutual Life Insurance Company may at its discretion provide a reward only for the earliest received submission. Eligibility for rewards, determination of the recipients for the rewards and the amount of rewards is at the discretion of the Northwestern Mutual Life Insurance Company.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIf issues reported to our bug bounty program affect a third party or another vendor, the Northwestern Mutual Life Insurance Company reserves the right to forward details of the issue along to the party without further discussion with the researcher.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou are responsible for all taxes associated with and imposed on any reward you may receive from the Northwestern Mutual Life Insurance Company.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIf you inadvertently access proprietary customer, employee, or business related information during your testing, the information must not be used, disclosed, stored, recorded or processed any further in any way. Inadvertent access to this type of data must be disclosed within your submission with identifying information of the data source and remediation you have taken to secure the data.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYour research activities must not negatively impact the Northwestern Mutual Life Insurance Company’s or LearnVest’s product or services in any way or the online environment availability or performance of such products or services.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eThese terms and conditions along with the specifications, requirements and restrictions set forth in the bug bounty brief constitute the entire Agreement of the parties. This Agreement is covered by California law. This agreement can only be amended by the Northwestern Mutual Life Insurance Company.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIf any part of this Agreement is found to be illegal or unenforceable, then the parties will be relieved of their responsibilities arising under such portion, but only to the extent that such art of the Agreement is illegal or unenforceable.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou must not be the author of the code identified as a vulnerability.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou must not be an employee or spouse of an employee of the Northwestern Mutual Life Insurance Company or any of its affiliates or subsidiaries, including the Northwestern Mutual Wealth Management Company, NMIS, or LearnVest.\u003c/p\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003eTHE NORTHWESTERN MUTUAL LIFE INSURANCE COMPANY ON BEHALF OF ITSELF AND AFFILIATES AND SUBSIDIARIES RESERVES THE SOLE RIGHT TO MODIFY THIS AGREEMENT WITHOUT NOTICE. ALL PARTICIPANTS AND SUBMISSIONS ARE STRICTLY VOLUNTARY. THIS OFFER IS VOID WHERE PROHIBITED BY AND BY PARITICPATING YOU ACKNOWLEDGE AND AGREE YOU WILL ABIDE BY ALL APPLICABLE FEDERAL, STATE AND LOCAL LAWS. YOU MUST ALSO NOT DISRUPT AND SERVICE OR COMPROMISE ANY PERSON’S DATA.\u003c/p\u003e"},"scope":[{"id":"a63216d4-62a0-48be-bd63-be0510dfb1ae","name":"🎯 In Scope - Public Facing Targets Owned by Northwestern Mutual","targets":[{"id":"11a33a36-5aa9-4c74-8eb7-5af51ae30e73","uri":"","name":"Anything Owned by Northwestern Mutual on the Public Internet Not Listed as Out of Scope","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"36a8763f-3db9-4a9a-985f-be5285ce7a14","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"11a33a36-5aa9-4c74-8eb7-5af51ae30e73"}],"recentChangeFlags":null},{"id":"fb4871cc-b539-4081-bb27-97e509393b40","uri":"","name":"216.20.176.0/20","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a8214919-8609-4aa4-8cd9-f74db46db88e","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fb4871cc-b539-4081-bb27-97e509393b40"}],"recentChangeFlags":null},{"id":"b25a8078-81b3-4afd-babb-55f73f7d1931","uri":"https://northwesternmutual.com","name":"*.northwesternmutual.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"490bea5e-61db-4d49-9fc9-da970e326f72","sortOrder":2},"sortOrder":2,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"b25a8078-81b3-4afd-babb-55f73f7d1931"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"b25a8078-81b3-4afd-babb-55f73f7d1931"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"b25a8078-81b3-4afd-babb-55f73f7d1931"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b25a8078-81b3-4afd-babb-55f73f7d1931"},{"id":"c3412833-26e7-4bbd-907f-760d9da61232","name":"Newrelic","targetId":"b25a8078-81b3-4afd-babb-55f73f7d1931"}],"recentChangeFlags":null},{"id":"2401bcd0-9cda-4aec-9215-3205f1619007","uri":"https://*.nml.com","name":"*.nml.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"670f8619-3dcf-46a5-849a-7223486d247e","sortOrder":3},"sortOrder":3,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"2401bcd0-9cda-4aec-9215-3205f1619007"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2401bcd0-9cda-4aec-9215-3205f1619007"}],"recentChangeFlags":null},{"id":"20310951-158e-4a45-92dd-c1e20108c0eb","uri":"https://*.nmfn.com","name":"*.nmfn.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3f10c25d-695c-46f1-bab4-f6ca08784e48","sortOrder":4},"sortOrder":4,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"20310951-158e-4a45-92dd-c1e20108c0eb"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"20310951-158e-4a45-92dd-c1e20108c0eb"}],"recentChangeFlags":null},{"id":"f79ac764-9312-4c53-b080-21d9b0f334f3","uri":"https://play.google.com/store/apps/details?id=com.nm.nm\u0026hl=en_US\u0026gl=US","name":"NM Android Mobile App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"219e184a-d2a0-4c59-80ac-5606556e9d37","sortOrder":5},"sortOrder":5,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"f79ac764-9312-4c53-b080-21d9b0f334f3"}],"recentChangeFlags":null},{"id":"0cabddd8-d8e1-411e-a218-fac9cf91fa2f","uri":"https://apps.apple.com/us/app/northwestern-mutual/id1132579006","name":"NM iOS Mobile App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6dcab7eb-8ab1-4d84-b05d-67a64e3b590e","sortOrder":6},"sortOrder":6,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"0cabddd8-d8e1-411e-a218-fac9cf91fa2f"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"9569b56e-f9e9-4246-8a45-c1bf3a4837ef","p1MaxCents":600000,"p1MinCents":400000,"p2MaxCents":300000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":50000,"p4MaxCents":30000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eThese rewards only apply to assets that are owned by Northwestern Mutual and are not listed as Out of Scope. If a submission is determined to be owned or run by a third party, it will be re-classified to the Other Public Targets section of targets. As these contain production systems that may send information to real individuals, you must use your @bugcrowdninja email for any form field asking for an email, as well as to always adhere to the Out-of-Scope information below. \u003c/p\u003e","rewardRangeData":{"1":{"min":4000,"max":6000},"2":{"min":1000,"max":3000},"3":{"min":500,"max":1000},"4":{"min":200,"max":300},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"464d3f69-5fb3-42db-a55b-d9d2f3cadb66","name":"🐞 In Scope - Other Public Targets (Vulnerability Disclosure)","targets":[{"id":"82a2b9ff-c569-485b-a165-4c01f8ad78a7","uri":"","name":"Anything that Clearly Affects Northwestern Mutual But is Not Own by Northwestern Mutual","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f9578a87-46ce-41ba-be9a-a999508b448d","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"82a2b9ff-c569-485b-a165-4c01f8ad78a7"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"414fa481-fdf8-4316-8662-616c1103c315","p1MaxCents":50000,"p1MinCents":null,"p2MaxCents":25000,"p2MinCents":null,"p3MaxCents":15000,"p3MinCents":null,"p4MaxCents":5000,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eIf you find a public facing issue that clearly affects Northwestern Mutual, but is not in scope for the Public Bug Bounty (i.e. not owned by Northwestern Mutual), you may responsibly disclose the vulnerability under this group. Issues submitted  to the main Public Bug Bounty group that are determined to not be owned by Northwestern Mutual will also be moved into this scoping group. We may consider giving a consolation bounty at these lower amounts for these bugs. The severity for these submissions will be based on the impact to Northwestern Mutual directly, which may differ from the normal VRT. There is a higher threshold for duplicate issues in this scope. Similar or variants of the same bugs will be considered duplicates. We may cap the quantity of these consolation rewards to one per new target. We do not condone or grant permission to test third party assets without their permission.\u003c/p\u003e","rewardRangeData":{"1":{"min":0,"max":500},"2":{"min":0,"max":250},"3":{"min":0,"max":150},"4":{"min":0,"max":50},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"e1b4af5f-9443-43bd-8b50-096555972cf7","name":"❌ Out of Scope - General","targets":[{"id":"b0d82f79-feb4-453e-b50a-317062ddf1da","uri":null,"name":"northwesternmutual.com/find-a-financial-advisor/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7ac0ee2c-3e61-487f-ad38-f4a3a2d42682","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b0d82f79-feb4-453e-b50a-317062ddf1da"}],"recentChangeFlags":null},{"id":"47b7e6e9-04d8-49ce-9615-0ae5b82cad4f","uri":"","name":"northwesternmutual.com/financial/advisor/*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"755b1bb6-c280-4b04-86c5-56c281fabceb","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"47b7e6e9-04d8-49ce-9615-0ae5b82cad4f"}],"recentChangeFlags":null},{"id":"b323db83-9518-41f4-8833-3173a8e90a55","uri":null,"name":"northwesternmutual.com/careers-apply/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"14792dec-6b2e-4944-bb5d-50edc490ae80","sortOrder":8},"sortOrder":8,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b323db83-9518-41f4-8833-3173a8e90a55"}],"recentChangeFlags":null},{"id":"7f8ce6e2-3f0d-4915-a234-fc88615d42cd","uri":null,"name":"northwesternmutual.com/report-a-death/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3528fdd6-b7e5-48e4-858c-d585ee55d79b","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7f8ce6e2-3f0d-4915-a234-fc88615d42cd"}],"recentChangeFlags":null},{"id":"947db3d1-7cbe-4c1d-991e-671853252c46","uri":null,"name":"northwesternmutual.com/notice-of-long-term-care-form/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cc63ee59-b24e-47de-925b-8795a0b312a2","sortOrder":10},"sortOrder":10,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"947db3d1-7cbe-4c1d-991e-671853252c46"}],"recentChangeFlags":null},{"id":"7eacea21-2bca-42ef-91d6-10833b1b86be","uri":"","name":"northwesternmutual.com/financial-professionals/?name=*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"efe1927b-688c-40ec-aaa8-9bd79bb0e1df","sortOrder":11},"sortOrder":11,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7eacea21-2bca-42ef-91d6-10833b1b86be"}],"recentChangeFlags":null},{"id":"de20ea46-69a7-4d83-a0a4-9fc550a53120","uri":"","name":"northwesternmutual.com/notice-of-disability-form/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5fa141a1-0981-4611-85ce-c3af0074252d","sortOrder":12},"sortOrder":12,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"de20ea46-69a7-4d83-a0a4-9fc550a53120"}],"recentChangeFlags":null},{"id":"28270228-758d-4829-b973-3dd846a3577a","uri":"","name":"northwesternmutual.com/notice-of-group-disability-form/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3dcea9fa-8968-4024-9eb5-edbcbf274f11","sortOrder":13},"sortOrder":13,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"28270228-758d-4829-b973-3dd846a3577a"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eOut-of-Scope Activities\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eExploitation past proof of vulnerability\u003c/li\u003e\n\u003cli\u003eVolumetric Denial of Service attacks (DoS)/distributed denial of service (DDoS)\u003c/li\u003e\n\u003cli\u003eVulnerabilities identified with automated tools (including web scanners) that do not include PoC code or a demonstrated exploit\u003c/li\u003e\n\u003cli\u003eDiscovery of any in-use service whose running version includes known vulnerabilities without demonstrable security impact\u003c/li\u003e\n\u003cli\u003ePhysical Testing\u003c/li\u003e\n\u003cli\u003eSocial engineering of any kind\u003c/li\u003e\n\u003cli\u003eAny attack against Northwestern Mutual Life Insurance Company and its subsidiaries including Northwestern Mutual Wealth Management Company, Northwestern Mutual Investment Services (NMIS) and LearnVest that are not explicitly in scope\u003c/li\u003e\n\u003cli\u003eLeaked passwords or breached credentials (i.e. credential breach dumps)\u003c/li\u003e\n\u003cli\u003eAny financial data linked from https://vlunttrn.nmfn.com/data.html - This is publicly disclosed financial data for regulatory purposes.\u003c/li\u003e\n\u003cli\u003eReferences to Google Maps API Key\u003c/li\u003e\n\u003cli\u003eDiscovery of @nm.com or @nmfn.com email addresses or phone numbers/contact information for these users - These are a sales force that are intended to be discoverable and contactable by the public\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eProduction Systems\u003c/h2\u003e\n\n\u003cp\u003eThe following pages have forms that submit data to real systems and are out of scope for any Bugcrowd program. This includes the API calls they make as well. We are working on a way to include them in the program in the future.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"e4c169ad-ec2e-433c-9822-23300091211c","name":"❌ Temporary Rules","targets":[{"id":"50d409fe-5e6f-4e98-8019-288690cc6835","uri":"","name":"Any Domain that Follows the Pattern */webforms/nmfnForms/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f2511148-bbcc-4ad5-bb4b-4656318537e6","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"386ced31-b00b-4465-892a-8b060dcc3a05","uri":"","name":"servicenmfn.awms.apps.northwesternmutual.com/webforms/nmfnForms/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"11873af2-ee29-4985-a61c-90d0644451d6","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"d1f4c474-ceb8-4a23-9463-8b18e7abdc56","uri":"","name":"servicenmfnstage.awms.apps.northwesternmutual.com/webforms/nmfnForms/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5be57804-5d8d-4f38-89e8-54c30d85c6ff","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"4c49b5f6-5d75-46e1-b068-cb4b931ae8bf","uri":"","name":"servicenmfntest.awms.apps.northwesternmutual.com/webforms/nmfnForms/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3c7a4255-f337-4485-815a-3f39960b79b2","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"1e24236c-38ea-4273-b8a7-f5ec9aa1974e","uri":"","name":"service.nmfn.com/webforms/nmfnForms/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7ff18820-d1f6-410e-90a0-b46f7ab77dd1","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"6569c19e-2dc8-4a42-9954-edc6d70aa6f1","uri":"","name":"servicestage.nmfn.com/webforms/nmfnForms/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6b0d3d0d-93a9-4da4-a9c0-d3bc4724f76d","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"e83f127d-fb48-4c56-8baf-2eeedb422892","uri":"","name":"servicetest.nmfn.com/webforms/nmfnForms/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c01ff49e-6bcd-4bf7-a369-529996039b87","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":3,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eTemporary Out-of-Scope Submission Types\u003c/h2\u003e\n\n\u003cp\u003eThe following types of submissions are not being accepted at this time. They may be accepted again in the future:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eDNS Zone Domain Takeover of Non-Live Domains\u003c/li\u003e\n\u003cli\u003eBroken link type issues on pages older than 1 year on news.northwesternmutual.com\u003c/li\u003e\n\u003cli\u003eRate limiting issues on news.northwesternmutual.com\u003c/li\u003e\n\u003cli\u003eCache Poisoned Denial of Service (CPDoS) style attacks\u003c/li\u003e\n\u003cli\u003eBroken social media link type issues on northwesternmutual.com/office/*\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eTemporary Bounty Cap\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eBroken social media link type issues are capped at $50 across the program\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eTemporary Out-of-Scope Domains\u003c/h2\u003e\n\n\u003cp\u003eSubmissions from the following domains are not being accepted at this time. They may be accepted again in the future:\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"bde85a89-6a2c-4106-a97b-d078af0fdfa6","name":"❌ Out of Scope - Known Third Party","targets":[{"id":"325ce3de-5e86-46df-96cf-f4974d616194","uri":"","name":"calculator.northwesternmutual.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"961a26ea-ed4a-4817-9823-c65ed28aa993","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a3d93391-bbf1-43c4-aaab-5d1ad94b3ee4","uri":"","name":"gbpwealth.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"596fd613-7f0c-49f2-ab35-4934d8e9775f","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null},{"id":"6857313f-41df-4634-8749-07cf073f4df6","uri":"","name":"mymhs.nmfn.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d4c4858f-4b24-42e9-a252-da2d90ac4b38","sortOrder":15},"sortOrder":15,"tags":null,"recentChangeFlags":null},{"id":"8ced9d5a-5399-496a-8b70-855c991ed856","uri":"","name":"nmresearchlibrary.nml.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1e8064d5-7a33-4bbd-9918-347a6faae70a","sortOrder":19},"sortOrder":19,"tags":null,"recentChangeFlags":null},{"id":"3fd11234-2165-4dc8-9ff1-7595a2401672","uri":"","name":"nwm.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a7cf0d20-fcf0-4e68-9852-a73e8d96bb9c","sortOrder":25},"sortOrder":25,"tags":null,"recentChangeFlags":null},{"id":"cfe30790-11eb-4370-9686-28d95a6c3426","uri":"","name":"sparks-financial.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1696f62b-64bd-4daa-a9cf-1a9cfa12a44a","sortOrder":31},"sortOrder":31,"tags":null,"recentChangeFlags":null},{"id":"bd54a440-e657-4344-8331-4babec54c92d","uri":"","name":"theandersonfinancialgroupnm.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0b85dfd1-485e-4e2a-962b-83e05a667696","sortOrder":32},"sortOrder":32,"tags":null,"recentChangeFlags":null},{"id":"a8767e54-b3eb-4d42-8be0-f458220322b0","uri":"","name":"themint.org","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cd0ee8c0-f82c-4a2b-8300-275aba80605e","sortOrder":33},"sortOrder":33,"tags":null,"recentChangeFlags":null},{"id":"050f531a-2e13-428e-b05c-b2a96a0bfa1d","uri":"","name":"21fiveca.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"97592e9e-13f7-4b09-a256-7b37d722bce4","sortOrder":36},"sortOrder":36,"tags":null,"recentChangeFlags":null},{"id":"7d326839-922e-4b18-b0f2-d9a58f2dc94e","uri":"","name":"Emerald Publications","category":"ip_address","ipAddress":"Anything That Resolves to 199.59.136.0 - 199.59.139.255 (CIDR: 199.59.136.0/22)","description":null,"engagementBriefTargetGroupTarget":{"id":"9c8a82b3-8813-4135-b9d1-fd4b1977c537","sortOrder":37},"sortOrder":37,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":4,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThe following pages have been determined as third party and not owned by Northwestern Mutual. We will not be paying any type of bounties for these domains\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"bc95f457-39ea-4bbc-80a6-f01f8f914ee7","code":"northwestern-mutual-mbb-og","state":"in_progress","endsAt":null,"bountyId":"66198514-09bc-4873-a6e9-cfee3ffe7977","startsAt":"2024-11-21T03:29:11Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Insurance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/91e1/9180/e8d9b98b/88d1723a44746f956e1a6ae810d88076_nwmutual.jpeg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-11-21T03:29:11.722Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/northwestern-mutual-mbb-og","changelogs":"/engagements/northwestern-mutual-mbb-og/changelog","submissions":null,"announcements":"/engagements/northwestern-mutual-mbb-og/announcements","hallOfFame":"/engagements/northwestern-mutual-mbb-og/hall_of_fames","crowdstream":null},"announcementsCount":0,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/northwestern-mutual-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":"updated","userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=northwestern-mutual-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/northwestern-mutual-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/northwestern-mutual-mbb-og/changelog","publishedAt":"2026-10-01T15:33:26.210Z","engagementChangelogUrl":"/engagements/northwestern-mutual-mbb-og/changelog/023b04b9-26c1-48eb-8fe2-142a83ebc901","createUserFeedbacksUrl":"/engagements/northwestern-mutual-mbb-og/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}