{"id":"90947bf4-bb77-470a-85a7-a71bc80b9ef2","engagementId":"ab35774f-3c46-425d-b8b1-fd622f1d1647","data":{"brief":{"id":"d242c679-d7cb-4273-8377-9a07099a784e","name":"Nubank Brasil Managed Bug Bounty Program","tagline":"Nubank Brasil is in a mission to fight complexity to empower people in their daily lives by reinventing financial services. Please submit your findings to this Bug Bounty Program.","description":"\u003cp\u003eWe are one of the world’s largest digital banking platforms, serving more than 100 million customers across Brazil, Mexico, and Colombia. Nubank Brasil leverages proprietary technologies and innovative business practices to create new financial solutions and experiences for individuals and SMEs that are simple, intuitive, convenient, low-cost, empowering, and human.\u003c/p\u003e\n\n\u003cp\u003eNo technology is perfect, and Nubank Brasil believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our targets. \u003c/p\u003e\n\n\u003cp\u003eYou can feel free to start testing Nubank and reporting your bugs both using our apps, and our wildcards. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eResponse Targets\u003c/h2\u003e\n\n\u003cp\u003eNubank's Security Team will make the best effort to meet the following SLAs for hackers participating in our program:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eFirst Response: 2 days\u003c/li\u003e\n\u003cli\u003eTime to Triage: 2 days\u003c/li\u003e\n\u003cli\u003eTime to Resolution: depends on severity and complexity\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eWe’ll try to keep you informed about our progress throughout the process.\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003cp\u003e\u003cstrong\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Nubank Brasil not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Nubank Brasil, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/strong\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eIf you are a Brazilian researcher who owns a Taxpayer Registry number (CPF, in Brazil), you can also authenticate yourself so you can reach further results in your tests. In order to do that, you would just need to create an account in Nubank. You can start this process by downloading our apps on PlayStore and AppStore using your Android or iOS device. \u003c/p\u003e\n\n\u003cp\u003ePlease, also keep your personal information handy and attend a few prerequisites in order to successfully complete the process of creating an account with Nu, as a standard customer would:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eTo be over 18 years old;\u003c/li\u003e\n\u003cli\u003eTo have a CPF register;\u003c/li\u003e\n\u003cli\u003eTo have a compatible device with the current version of our apps in Play Store and App Store;\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eGiven that, you just need to follow basic steps on the app's initial page and provide your personal information as the register flow requests it, including a picture of your ID. (RG, in Brazil) Your account will need to be approved by our teams, which normally takes less than one business day to happen. \u003c/p\u003e\n\n\u003ch3\u003eReporting Account Blocks for Fraud Suspicion\u003c/h3\u003e\n\n\u003cp\u003eIf your account is blocked due to suspected fraud during testing, please notify us as soon as possible and include details of the tests performed. We encourage you to submit a new report with the information to help us clarify the situation and address any concerns. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eProgram Rules\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eIn order to ensure that your activity is not mistaken as malicious and blocked, we're asking that you use HTTP Headers. Example: \"X-Correlation-Id: bc-handle\"\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ePlease provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eSubmit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWhen duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eMultiple vulnerabilities caused by one underlying issue will be treated as one valid report.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eMake a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ePlease note that only individuals with a valid Tax Identification Number (such as CPF in Brazil, CURP/RFC in Mexico, or NIT in Colombia) will be able to sign up for bank accounts with NuBank. Any use of false identification or fraudulent activities is explicitly out of scope.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAll areas of scope outside of those requiring a Brazilian TIN can be accessed by hackers outside of this region.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eParticipation in this program by Nubank's employees and/or Third Party Providers is not permitted and any reports submitted will be considered invalid.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003ePoC Monetary Limit\u003c/h3\u003e\n\n\u003cp\u003eTo avoid potential issues with tests involving excessively high values, we have set a maximum limit of R$ 10 (or the minimum possible amount) for Proofs of Concept (PoCs).This ensures that tests remain within a manageable scope and helps prevent unforeseen complications.\u003c/p\u003e\n\n\u003ch3\u003eQuality Reporting\u003c/h3\u003e\n\n\u003cp\u003eWhen reporting an issue to this program, please be sure to include the following:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ea detailed replication steps (how to replicate this issue - in a step by step manner that could be followed by even non security-involved persons)\u003c/li\u003e\n\u003cli\u003ea real-world exploit scenario (elaborate on WHAT an attacker could do with this vulnerability, and HOW they would go about doing so - please do not deal in extreme hypotheticals - e.g. those that would require the intervention of a nation-state, etc)\n-Please note that remediation steps must be actionable, and not generic advice such as “ensure that user input is sanitized”, etc.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eSubmissions lacking detailed exploitation steps will not be eligible for reward\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cp\u003eWhile you’re free to test on any in scope targets on the brief, we’d like you to focus your special attention on the above targets and go deep to find critical issues.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eNubank iOS: App Store\u003c/li\u003e\n\u003cli\u003eNubank Android: Play Store\u003c/li\u003e\n\u003cli\u003eWildcard *.nubank.com.br, *.nu.com.mx, *.nu.com.co\u003c/li\u003e\n\u003cli\u003eNuInvest\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cp\u003eWhen reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) security impact of the bug. The following issues are considered out of scope:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCredential leakages from end users that were not resulted by a failure from Nubank's resources.\u003c/li\u003e\n\u003cli\u003eSubdomain takeover reports require a working proof-of-concept demonstrating actual impact; dangling DNS records alone are not sufficient.\u003c/li\u003e\n\u003cli\u003eSocial engineering (e.g. phishing, vishing, smishing) is prohibited.\u003c/li\u003e\n\u003cli\u003eClickjacking on pages with no sensitive actions\u003c/li\u003e\n\u003cli\u003eCross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no proved impact\u003c/li\u003e\n\u003cli\u003eAttacks requiring a privileged network position are out of scope unless a server-side misconfiguration directly enables the attack.\u003c/li\u003e\n\u003cli\u003eReports of vulnerable third-party libraries are only considered if accompanied by a PoC demonstrating exploitability in Nubank's environment.\u003c/li\u003e\n\u003cli\u003eComma Separated Values (CSV) injection without demonstrating a vulnerability.\u003c/li\u003e\n\u003cli\u003eMissing best practices in SSL/TLS configuration.\u003c/li\u003e\n\u003cli\u003eAny activity that could lead to the disruption of our service (DoS).\u003c/li\u003e\n\u003cli\u003eContent spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\u003c/li\u003e\n\u003cli\u003eRate limiting or bruteforce issues on non-authentication endpoints\u003c/li\u003e\n\u003cli\u003eMissing best practices in SSL/TLS configuration. are out of scope unless accompanied by a concrete attack scenario beyond automated scanner output.\u003c/li\u003e\n\u003cli\u003eMissing HttpOnly or Secure flags are only considered when affecting sensitive cookies (e.g. session tokens) with a demonstrated exploitation scenario.\u003c/li\u003e\n\u003cli\u003eMissing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\u003c/li\u003e\n\u003cli\u003eVulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]\u003c/li\u003e\n\u003cli\u003eSoftware version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\u003c/li\u003e\n\u003cli\u003eTabnabbing\u003c/li\u003e\n\u003cli\u003eOpen redirect - unless an additional security impact can be demonstrated\u003c/li\u003e\n\u003cli\u003eIssues that require unlikely user interaction;\u003c/li\u003e\n\u003cli\u003eNuInvest's Hijacked Social Media\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAdditional Disclosure Information\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003ePlease do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without expressed consent from the organization.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eFollow Bugcrowd's \u003ca href=\"https://bugcrowd.com/resources/standard-disclosure-terms\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003estandard disclosure terms\u003c/a\u003e.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e*\u003cem\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/em\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"dc34dbf2-f1c9-4d2a-96b4-848d5d5fb85d","name":"Core Assets","targets":[{"id":"60d4e710-b248-40fe-9b93-c595d27b2c36","uri":"https://play.google.com/store/apps/details?id=com.nu.production\u0026hl=pt_BR\u0026gl=US\u0026pli=1","name":"Nubank Android: Play Store","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bb5b5c80-c75e-4b0f-9377-cf8e21e1e71a","sortOrder":0},"sortOrder":0,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"60d4e710-b248-40fe-9b93-c595d27b2c36"}],"recentChangeFlags":null},{"id":"b2c8cd58-1d0e-40d9-968e-a2af50869650","uri":"https://apps.apple.com/br/app/nubank-conta-e-cart%C3%A3o/id814456780","name":"Nubank iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"73b2f5ec-cbb2-4216-9899-87c9a0f6e8fb","sortOrder":0},"sortOrder":0,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"b2c8cd58-1d0e-40d9-968e-a2af50869650"}],"recentChangeFlags":null},{"id":"ee6c8e93-a0d6-4cfa-b2fb-cc7adda6f1d9","uri":"","name":"prod-*.nubank.com.br","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"67c34cd3-78c0-4def-8f5e-352cf0bafcb4","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a137f741-ae87-4251-af86-ae51aebd66f8","uri":"","name":"prod-*.nu.com.mx","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fb19f50d-8e5f-49e8-aa8c-95f718cdfbe4","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"dc757539-f568-47e3-a05b-e02f963225a6","uri":"","name":"prod-*.nu.com.co","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"36e73e8c-ed0a-44f5-a7f5-7107b0b87c2f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"f88a3fb7-f02a-49d0-95fe-84548fef5fd9","p1MaxCents":400000,"p1MinCents":200000,"p2MaxCents":200000,"p2MinCents":100000,"p3MaxCents":60000,"p3MinCents":30000,"p4MaxCents":10000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2000,"max":4000},"2":{"min":1000,"max":2000},"3":{"min":300,"max":600},"4":{"min":50,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"97b7e461-5540-48cf-a3c9-0fd06be50943","name":"Primary Assets","targets":[{"id":"5d22b436-d127-46bf-8e2d-e477a5cb93fe","uri":"https://nubank.com.br/","name":"*.nubank.com.br","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b6f13843-609c-4df8-9186-404c9cde4887","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"967230a0-10c8-472d-8644-1ea0e3f4a4a9","uri":"https://nubank.com.mx","name":"*.nu.com.mx","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a85774a3-28d0-4281-8082-c2d1731addb9","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c4a1b4c1-c0c1-4f85-a790-7d9610c6c746","uri":"https://nubank.com.co","name":"*.nu.com.co","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0b67b8ae-7996-4568-8c28-fb8c5f005679","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"bdc6e061-af7e-4ed6-a5be-433021479b1a","p1MaxCents":200000,"p1MinCents":100000,"p2MaxCents":100000,"p2MinCents":60000,"p3MaxCents":40000,"p3MinCents":30000,"p4MaxCents":10000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1000,"max":2000},"2":{"min":600,"max":1000},"3":{"min":300,"max":400},"4":{"min":50,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"382646d4-34e7-44e0-abeb-69fb53e1cfaa","name":"Supplementary Assets","targets":[{"id":"7ef5db86-20c2-48d5-b135-cb7f977dd66b","uri":"https://www.nuinvest.com.br/","name":"*.nuinvest.com.br\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"be618e2a-ec85-4b68-ab3d-ed0bfe33af4b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7ef5db86-20c2-48d5-b135-cb7f977dd66b"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"0a59b937-883e-4d26-b120-a020819d2953","p1MaxCents":100000,"p1MinCents":50000,"p2MaxCents":50000,"p2MinCents":30000,"p3MaxCents":30000,"p3MinCents":15000,"p4MaxCents":10000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":500,"max":1000},"2":{"min":300,"max":500},"3":{"min":150,"max":300},"4":{"min":50,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"0297c00b-c21f-42dc-92bf-996d5b86e0ec","name":"Out of Scope","targets":[{"id":"9045022f-3a6d-4f1d-ae4f-c9fe798370e5","uri":"","name":"*.nuinternational.com\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"16985c75-539a-460e-9ba0-b63ee3f334fd","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"64b4df6d-49f6-45d7-8f4a-015fddf6c603","uri":"","name":"*.nat-a.nubank.com.br","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"47f044ab-2e9f-4849-859a-163f66511cb6","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"5e82ec6d-8ba3-4b19-bad8-bb1b2143df8b","uri":"","name":"international.nubank.com.br","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"26692e2b-99ab-4a71-b8fc-c89eec611bd8","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"012ab2b3-90ab-4ee8-aab0-94f829f7113b","uri":"","name":"NuCommunity endpoints (BR, MX, CO)","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9ff805a8-0e34-4863-85f7-8e9048415387","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":3,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eNuCommunity assets (BR, MX, CO) are temporarily out of scope due to scheduled internal maintenance.\u003cbr\u003e\nWe will notify all researchers via broadcast as soon as they are available for testing again.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"ab35774f-3c46-425d-b8b1-fd622f1d1647","code":"nubank","state":"in_progress","endsAt":null,"bountyId":"b7a4183c-cf5f-4a70-bc32-c287d2b231de","startsAt":"2023-08-31T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/f21e/3f46/4f32c0b2/42cbdf52425e327f162e7df7a19e8614_nubank.png","logoBackgroundColor":"#8303d2","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2023-08-31T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/nubank","changelogs":"/engagements/nubank/changelog","submissions":null,"announcements":"/engagements/nubank/announcements","hallOfFame":"/engagements/nubank/hall_of_fames","crowdstream":"/engagements/nubank/crowdstream"},"announcementsCount":17,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/nubank/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=nubank\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/nubank/engagement_subscribers","engagementChangelogsUrl":"/engagements/nubank/changelog","publishedAt":"2026-06-26T16:31:32.866Z","engagementChangelogUrl":"/engagements/nubank/changelog/90947bf4-bb77-470a-85a7-a71bc80b9ef2","createUserFeedbacksUrl":"/engagements/nubank/feedbacks","engagementCrowdstreamUrl":"/engagements/nubank/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}