{"id":"0596f021-4ec5-453c-8ab9-08340895d163","engagementId":"97cc1a37-b14e-4b49-a2d1-253fe7a5b4be","data":{"brief":{"id":"8069738f-7157-42b0-846f-81b8caa8febd","name":"Origin Energy","tagline":"An electricity, natural gas, LPG and solar provider. A good energy company.","description":"\u003cp\u003eOrigin Energy invites you to test and help secure our primary publicly facing assets - focusing on our web applications. We appreciate your efforts and hard work in making the internet (and Origin Energy) more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"78192436-6ce2-4bc8-a809-e4a20c182519","targetsOverview":"\u003cp\u003e\u003cstrong\u003eRules of Engagement\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll email addresses belonging to researchers should be your \u003cstrong\u003e@bugcrowdninja.com\u003c/strong\u003e.\u003c/li\u003e\n\u003cli\u003eAny form submissions \u003cstrong\u003eMUST\u003c/strong\u003e use your  @bugcrowdninja.com email.\u003c/li\u003e\n\u003cli\u003eMake a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.\u003c/li\u003e\n\u003cli\u003eDo not modify data that does not belong to you.\u003c/li\u003e\n\u003cli\u003eTools that may result in a Denial Of Service (DoS) are prohibited.\u003c/li\u003e\n\u003cli\u003ePlease be sure to check domain records to confirm Origin Energy ownership; do not test assets not owned and controlled by Origin Energy.\u003c/li\u003e\n\u003cli\u003eThe use of Automated scanners \u003cstrong\u003eis strictly prohibited\u003c/strong\u003e.\u003c/li\u003e\n\u003cli\u003eChat functionality must not be tested.\u003c/li\u003e\n\u003cli\u003eSubmission of any forms (sign up etc) is \u003cstrong\u003estrictly prohibited.\u003c/strong\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eAccess\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eA large portion of targets are public facing are unauthenticated.\u003c/li\u003e\n\u003cli\u003eAuthenticated sections within our target may be tested provided the tester is an Origin customer and has MyAccount access. Out of scope targets must not be tested.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003e3rd Party Services\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eOrigin Energy uses several third-party providers and services – including a number hosted on subdomains of originenergy.com.au. We \u003cstrong\u003eDO NOT\u003c/strong\u003e authorize security testing against systems that do not belong to us, but strongly suggest reporting issues identified within these services to the third-party directly. If you believe an issue with one of our third-party service providers is the result of Origin Energy's misconfiguration or insecure usage of that service (or you've reported an issue affecting many customers of the service that you believe Origin Energy can temporarily mitigate without stopping usage of the service while a fix is implemented upstream), we'd appreciate your report regarding the issue.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eAreas of Focus\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eWe are especially interested in critical vulnerabilities that result in the unauthorized disclosure of Personally Identifiable Information (PII)\u003c/li\u003e\n\u003cli\u003eOf importance are vulnerabilities that subvert business controls e.g. offer redemption, discounts etc.\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eWe're also interested in traditional web application vulnerabilities, as well as other vulnerabilities that have demonstrable impact to Origin Energy and/or our customers. Below is a list of some of the vulnerability classes that we are seeking reports for:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eServer-side Remote Code Execution (RCE)\u003c/li\u003e\n\u003cli\u003eServer-Side Request Forgery (SSRF)\u003c/li\u003e\n\u003cli\u003eStored/Reflected Cross-site Scripting (XSS)\u003c/li\u003e\n\u003cli\u003eCross-site Request Forgery (CSRF)\u003c/li\u003e\n\u003cli\u003eSQL Injection (SQLi)\u003c/li\u003e\n\u003cli\u003eXML External Entity Attacks (XXE)\u003c/li\u003e\n\u003cli\u003eAccess Control Vulnerabilities (Insecure Direct Object Reference issues, etc)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eExclusions\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eLogout Cross-Site Request Forgery (logout CSRF)\u003c/li\u003e\n\u003cli\u003eLack of Secure/HTTPOnly flags on non-sensitive Cookies.\u003c/li\u003e\n\u003cli\u003eLogin or Forgot Password page brute force and account lockout not enforced.\u003c/li\u003e\n\u003cli\u003eLeaked or compromised credentials obtained from third-party sources (e.g., public data breaches, paste sites, credential dumps) rather than through direct exploitation of Origin Energy systems or infrastructure.\u003c/li\u003e\n\u003cli\u003eUsername / email enumeration/ Account Number.\u003c/li\u003e\n\u003cli\u003eMissing HTTP security headers, specifically (https://owasp.org/www-project-secure-headers/), e.g.\n\n\u003cul\u003e\n\u003cli\u003eStrict-Transport-Security.\u003c/li\u003e\n\u003cli\u003eX-Frame-Options.\u003c/li\u003e\n\u003cli\u003eX-XSS-Protection.\u003c/li\u003e\n\u003cli\u003eX-Content-Type-Options.\u003c/li\u003e\n\u003cli\u003eContent-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP.\u003c/li\u003e\n\u003cli\u003eContent-Security-Policy-Report-Only.\u003c/li\u003e\n\u003cli\u003eCache-Control and Pragma\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eSSL/TLS Issues, e.g.\n\n\u003cul\u003e\n\u003cli\u003eSSL Attacks such as BEAST, BREACH, Renegotiation attack.\u003c/li\u003e\n\u003cli\u003eSSL Forward secrecy not enabled.\u003c/li\u003e\n\u003cli\u003eSSL weak/insecure cipher suites.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eSelf-XSS reports will not be accepted.\u003c/li\u003e\n\u003cli\u003eVolume related issues or missing rate limiting protections i.e.. Brute-force, rate-limiting, denial of service, number enumeration.\u003c/li\u003e\n\u003cli\u003eSocial engineering of any kind against Origin employees or its users.\u003c/li\u003e\n\u003cli\u003eEmail configuration i.e. SPF, DKIM, DMARC.\u003c/li\u003e\n\u003cli\u003eError pages i.e. verbose error messages, stack traces, invalid status codes.\u003c/li\u003e\n\u003cli\u003eNon-sensitive exposed API keys e.g. QAS,\u003c/li\u003e\n\u003cli\u003eConfiguration that is not directly exploitable i.e.. weak TLS ciphers, password policy, session expiration, certificate pinning.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eSafe Harbor\u003c/strong\u003e\u003cbr\u003e\nWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.\u003c/p\u003e\n\n\u003cp\u003eNote: Origin Energy uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, Origin Energy will defer to the CVSS score to determine the priority.\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"e2877143-9e97-41fa-bd99-25880077cedc","name":"In Scope - Origin","targets":[{"id":"26c8a6aa-0558-4368-b3e9-c4332ecddfe4","uri":"https://www.originenergy.com.au/","name":"https://www.originenergy.com.au/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cf95ab07-e69b-4c64-85a1-a695d03d23ce","sortOrder":0},"sortOrder":0,"tags":[{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"26c8a6aa-0558-4368-b3e9-c4332ecddfe4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"26c8a6aa-0558-4368-b3e9-c4332ecddfe4"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"26c8a6aa-0558-4368-b3e9-c4332ecddfe4"}],"recentChangeFlags":null},{"id":"dd99912d-e320-41fa-b6af-580a2336a632","uri":"","name":"*.origindigital-pac.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"20d18e93-4095-42a1-bd42-953e2d658ea6","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"dd99912d-e320-41fa-b6af-580a2336a632"}],"recentChangeFlags":null},{"id":"a8352817-352c-4d66-b0b0-91ef10b0a77b","uri":"","name":"*.odcdn.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"db5551b9-d663-4eb5-9b3b-e236aa9ff19e","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a8352817-352c-4d66-b0b0-91ef10b0a77b"}],"recentChangeFlags":null},{"id":"7e6e7c5b-2bee-4454-9a69-7572c5bd1045","uri":"https://dataportal.originenergy.com.au","name":"dataportal.originenergy.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"522a6208-423b-4802-ad21-3dbdd01e44db","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7e6e7c5b-2bee-4454-9a69-7572c5bd1045"}],"recentChangeFlags":null},{"id":"ae7a09d5-a6a6-435f-b220-c8e22f58899c","uri":"","name":"*.support.originenergy.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6876c264-bff5-4bab-b4e3-db8bfb8bf204","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ae7a09d5-a6a6-435f-b220-c8e22f58899c"}],"recentChangeFlags":null},{"id":"59a141d8-9070-4d6d-879b-8ce16fa47288","uri":"","name":"*.api.originenergy.com.au","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"989857d1-9749-415d-b338-4780d0d4c29c","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"59a141d8-9070-4d6d-879b-8ce16fa47288"}],"recentChangeFlags":null},{"id":"1e0c568f-2c39-4f8b-ac56-8e026eb655a2","uri":"","name":"*.download.originenergy.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"05b21e37-0bb1-4590-8967-2b4aca30f781","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1e0c568f-2c39-4f8b-ac56-8e026eb655a2"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"34611e5d-c203-4087-8391-485528cf6cda","p1MaxCents":250000,"p1MinCents":150000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":50000,"p4MaxCents":50000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1500,"max":2500},"2":{"min":1000,"max":1500},"3":{"min":500,"max":1000},"4":{"min":50,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"7e9614d9-9dc9-4536-8820-83ae0c87ffac","name":"API - Origin","targets":[{"id":"56b42944-2c06-4136-aa4e-85c323b3f456","uri":"https://api.rx.originenergy.com.au/v1/lpg/graphql","name":"https://api.rx.originenergy.com.au/v1/lpg/graphql","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c7ecbc87-9ecf-4ae6-8247-9458ed2c5392","sortOrder":0},"sortOrder":0,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"56b42944-2c06-4136-aa4e-85c323b3f456"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"34611e5d-c203-4087-8391-485528cf6cda","p1MaxCents":250000,"p1MinCents":150000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":50000,"p4MaxCents":50000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1500,"max":2500},"2":{"min":1000,"max":1500},"3":{"min":500,"max":1000},"4":{"min":50,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"c8dc6fa8-3e91-4dfd-acda-905f53522c90","name":"Winconnect","targets":[{"id":"320f0240-9ace-485c-805f-94a49f8f8da5","uri":"https://www.winconnect.com.au/moving-out/","name":"https://www.winconnect.com.au/moving-out/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4d133c67-7327-4b58-8c17-697180a7c639","sortOrder":0},"sortOrder":0,"tags":[{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"320f0240-9ace-485c-805f-94a49f8f8da5"}],"recentChangeFlags":null},{"id":"5716015b-488e-42ef-81a3-3a8fa8f35f6d","uri":"https://www.winconnect.com.au/get-connected/","name":"https://www.winconnect.com.au/get-connected/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7594929d-55d3-47df-adb0-3ce388960c9f","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5716015b-488e-42ef-81a3-3a8fa8f35f6d"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"5716015b-488e-42ef-81a3-3a8fa8f35f6d"}],"recentChangeFlags":null},{"id":"bada68b1-b831-4a12-b0a3-8286fba6cbd0","uri":"https://customerportal.winconnect.com.au/login","name":"https://customerportal.winconnect.com.au/login","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d5219408-7140-4900-bb6e-34d17af6bda4","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bada68b1-b831-4a12-b0a3-8286fba6cbd0"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"bada68b1-b831-4a12-b0a3-8286fba6cbd0"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"34611e5d-c203-4087-8391-485528cf6cda","p1MaxCents":250000,"p1MinCents":150000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":50000,"p4MaxCents":50000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eWinconnect public facing assets\u003c/p\u003e","rewardRangeData":{"1":{"min":1500,"max":2500},"2":{"min":1000,"max":1500},"3":{"min":500,"max":1000},"4":{"min":50,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"77664d7c-a4f5-4492-9439-cab1d371744e","name":"MyConnect","targets":[{"id":"d0186a15-d011-461a-bf20-f5a0db57100c","uri":"","name":"portal.myconnect.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"349bb9f1-4439-4c1f-9d88-f03051a8bac6","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"041427f3-c106-4643-aec7-e137d5558146","uri":"","name":"myconnect.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f57f9daf-0410-4a57-a47e-e099202a8996","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"ccb18767-e68f-488c-bd18-be6f425608ad","uri":"","name":"portal.myconnect.com.au/new-connection","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8ab9a8b4-b22e-4093-a478-d12cfbd4218f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e3ca7ead-a139-45f1-92d1-3e30f8f4bc20","uri":"","name":"hub.myconnect.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"720ab0ee-c969-43e0-ae53-404fd034a71f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"43e8f09c-a6ae-439b-bdd6-a21e8e506db2","uri":"https://ssu.staging.myconnect.com.au/get-connected","name":"ssu.staging.myconnect.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"47848b13-51ea-493f-a226-b03a89e7b375","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":{"id":"f8523db8-907f-4203-98dc-bc19b98ec609","p1MaxCents":100000,"p1MinCents":75000,"p2MaxCents":75000,"p2MinCents":50000,"p3MaxCents":50000,"p3MinCents":25000,"p4MaxCents":25000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":750,"max":1000},"2":{"min":500,"max":750},"3":{"min":250,"max":500},"4":{"min":50,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"b257b869-bae6-4c11-9a91-e278c5dd5953","name":"Out of Scope","targets":[{"id":"df45b1fb-d06f-43c7-9eb7-6fba1457338d","uri":"https://www.originenergy.com.au/moving/","name":"https://www.originenergy.com.au/moving/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0d90aae1-addc-4408-8a30-893e81355c20","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"9301164e-9652-4c4c-a496-fbf6c970c9a6","uri":"","name":"https://auth.api.originenergy.com.au/**","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6b1d0baf-c38e-4d1b-bb8a-ee72a019afd7","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9301164e-9652-4c4c-a496-fbf6c970c9a6"}],"recentChangeFlags":null},{"id":"f8476dfc-82d0-48e7-9e92-f0353f46273a","uri":"","name":"https://origin-energy.formstack.com/**","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b2d3104c-471f-4cb8-83e7-3e0b0c288f83","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"93761fa4-2422-4a65-90b2-b652c8fe0f4a","uri":"https://ssu.myconnect.com.au/**","name":"https://ssu.myconnect.com.au/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9a17bfe8-a63c-483c-b05f-2269d88da13c","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"9ac68b2c-3d8f-4b9b-83c1-163086c92f6e","uri":"https://reneweclipse.originenergy.com.au/*","name":"Renew Eclipse","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"806cc045-ed4b-41de-8148-3712b6f89f7b","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"7a0bd005-a9a5-4868-ac50-b99d1b3458aa","uri":"https://api.rx.originenergy.com.au/v1/gateway/schema/graphql","name":"GraphQL Schema","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5de4cd86-d130-4552-9f9f-70bf653605da","sortOrder":5},"sortOrder":5,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"7a0bd005-a9a5-4868-ac50-b99d1b3458aa"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":4,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"933a4762-bbcc-4c15-9ddb-7267f85ea731","name":"1Bill","targets":[{"id":"1ddce729-7528-48a6-95bf-96aa513729a8","uri":"","name":"https://www.compareandconnect.com.au/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ba62f5a5-16b7-4fce-ab05-c95cf9c8715a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"32d7e3ee-5952-48b5-b976-a606b379623e","uri":"","name":"https://agent.compareandconnect.com.au/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b961d67b-2c81-4160-a07a-6f3a63cbd74a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e5fe9085-fdfe-4bfc-a6fa-14dfcd745be0","uri":"","name":"https://fastconnect.co.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0dd73676-5133-4b1f-877d-96b82c6da753","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"1b720391-4e83-4577-a67b-cf863df8862c","uri":"","name":"https://Yourporter.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"861c8d13-ea21-4b1c-9e60-c663a9f91b77","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7b97cb9b-92fb-4e33-b652-d4ca14724a5a","uri":"","name":"https://raywhitehomenow.com/ ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"86a580b5-d64a-4791-9be9-19dc720f3491","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":5,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"8702ed30-4514-4feb-a28c-11bca4412342","name":"SolarQuotes","targets":[{"id":"78d249bb-afc9-42fc-a7a9-852b85a2b8a2","uri":"https://www.solarquotes.com.au/leads/","name":"solarquotes.com.au/leads","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f9a22b12-05cf-420b-ad29-a0801950e3b6","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"d014d539-ff22-4590-8c09-9aff0b10ba0b","uri":"https://www.solarquotes.com.au/suppliers/","name":"solarquotes.com.au/suppliers","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"62613cba-518a-4edc-8791-d7bb974848fc","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"cf16b03a-57eb-4093-ad9e-18c72ec953eb","uri":"https://www.solarquotes.com.au/wp-admin/","name":"solarquotes.com.au/wp-admin","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f61f6407-36b5-4022-be65-0c4965a50601","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"a3a5ef43-1b2f-473b-9d2b-f6e069fa31c3","uri":"https://manufacturers.solarquotes.com.au/","name":"manufacturers.solarquotes.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"41a9b4a0-64bc-45ba-9da0-b15236ef6cdf","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"422421ec-1ba9-403b-8030-2f9a9b85908c","uri":"https://www.solarquotes.com.au/quote/start/","name":"solarquotes.com.au/quote/start","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e7dfbba3-a492-411b-9a6e-4d3bc09c8ba4","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"5d9740ec-bd4d-4adb-a14f-880dedc4a008","uri":"https://www.solarquotes.com.au/quotesv2/","name":"solarquotes.com.au/quotesv2","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d475b38f-2da6-4156-840f-954c4e8e510f","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":6,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"cf623f5b-d75c-4411-8400-a475e45f29ea","name":"Kinergy","targets":[{"id":"d37ad388-20ff-4b51-a13c-a9fd8ba79b86","uri":"https://portal.anz.kinergysolutions.com","name":"portal.anz.kinergysolutions.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6e43d1a5-3480-457d-af62-be3a8aa142d1","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d37ad388-20ff-4b51-a13c-a9fd8ba79b86"}],"recentChangeFlags":null},{"id":"3c8faf1f-b5df-450c-a087-0c5df27bd486","uri":"https://portal-api.anz.kinergysolutions.com","name":"portal-api.anz.kinergysolutions.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b142e29e-c241-4728-b8b1-bcc58e0d2e3b","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"3c8faf1f-b5df-450c-a087-0c5df27bd486"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":7,"description":null,"rewardRange":{"id":"752ab44a-cdd3-4167-8f8d-0dac3bd27e54","p1MaxCents":250000,"p1MinCents":150000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":50000,"p4MaxCents":25000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1500,"max":2500},"2":{"min":1000,"max":1500},"3":{"min":500,"max":1000},"4":{"min":50,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"f459019e-cf75-479a-8f05-f26aae2c4284","name":"Origin Zero","targets":[{"id":"ac2d6877-36e8-43ce-925a-16c2f567198e","uri":"https://portal.originzero.com.au","name":"portal.originzero.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0ae4fdbb-4e8e-488d-b2d9-e01d9b1f9858","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ac2d6877-36e8-43ce-925a-16c2f567198e"}],"recentChangeFlags":null},{"id":"2c425686-29e0-4ab3-aaa0-d273ecdc8c16","uri":"https://api-portal.originzero.com.au","name":"api-portal.originzero.com.au","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f5a950ee-4d03-4c92-bf1b-6dc9d4602f2f","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"2c425686-29e0-4ab3-aaa0-d273ecdc8c16"}],"recentChangeFlags":null},{"id":"177919ef-d69d-4157-b6ea-1c3d48db4ee1","uri":"https://sign.originzero.com.au","name":"sign.originzero.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"17b22d38-0978-4af6-ab7c-8e85dbb213f7","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"177919ef-d69d-4157-b6ea-1c3d48db4ee1"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":8,"description":null,"rewardRange":{"id":"752ab44a-cdd3-4167-8f8d-0dac3bd27e54","p1MaxCents":250000,"p1MinCents":150000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":50000,"p4MaxCents":25000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1500,"max":2500},"2":{"min":1000,"max":1500},"3":{"min":500,"max":1000},"4":{"min":50,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"7e19ca8e-aabc-4751-9054-ee2ca7fcc126","name":"MyBusiness","targets":[{"id":"85f6a5f2-c90b-4c39-b681-6a0caa879b06","uri":"https://businessportal.origin.com.au","name":"businessportal.origin.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8cf8d72e-5e2c-49b1-aa8e-42111a40d744","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"85f6a5f2-c90b-4c39-b681-6a0caa879b06"}],"recentChangeFlags":null},{"id":"ce821048-14b1-4e76-a428-b8675021eb63","uri":"https://api-businessportal.origin.com.au","name":"api-businessportal.origin.com.au","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2243a113-6a90-4221-a98b-9261e2a48d4a","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"ce821048-14b1-4e76-a428-b8675021eb63"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":9,"description":null,"rewardRange":{"id":"752ab44a-cdd3-4167-8f8d-0dac3bd27e54","p1MaxCents":250000,"p1MinCents":150000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":50000,"p4MaxCents":25000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1500,"max":2500},"2":{"min":1000,"max":1500},"3":{"min":500,"max":1000},"4":{"min":50,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"97cc1a37-b14e-4b49-a2d1-253fe7a5b4be","code":"originenergy-og1","state":"in_progress","endsAt":null,"bountyId":"08ce4983-43e4-41c7-a9e8-0be23b33d50f","startsAt":"2018-12-20T19:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Utilities","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/950d/4899/0292dfa6/a91715fbef94b384d55b9eaf3b66c7d5_IA6jCLqi_400x400.jpg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2018-12-20T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/originenergy-og1","changelogs":"/engagements/originenergy-og1/changelog","submissions":null,"announcements":"/engagements/originenergy-og1/announcements","hallOfFame":"/engagements/originenergy-og1/hall_of_fames","crowdstream":null},"announcementsCount":9,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/originenergy-og1/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=originenergy-og1\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/originenergy-og1/engagement_subscribers","engagementChangelogsUrl":"/engagements/originenergy-og1/changelog","publishedAt":"2026-08-10T08:13:09.092Z","engagementChangelogUrl":"/engagements/originenergy-og1/changelog/0596f021-4ec5-453c-8ab9-08340895d163","createUserFeedbacksUrl":"/engagements/originenergy-og1/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}