{"id":"1eb84c9b-169a-4ad9-b1d0-968300dd321d","engagementId":"5ecf8a9d-cb5f-4b6a-86e2-4aa8b65d77e9","data":{"brief":{"id":"767a3f69-7957-4796-a614-a697998c07a2","name":"Bed Bath and Beyond, Inc. | Vulnerability Disclosure Program","tagline":"Bed Bath and Beyond is an online retailer based out of the United States.","description":"\u003cp\u003eBed Bath and Beyond encourages you to responsibly report security issues identified on our digital properties.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"1bf3970a-395b-4456-b261-d04dab482af2","targetsOverview":"\u003cp\u003e\u003cem\u003eAny domain/property of Bed Bath and Beyond not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget info:\u003c/h2\u003e\n\n\u003ch3\u003ebedbathandbeyond.com\u003c/h3\u003e\n\n\u003cp\u003e\u003cem\u003ePlease note this is a production environment.\u003c/em\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not conduct tests against customer accounts (e.g. accounts you do not expressly own)\u003c/li\u003e\n\u003cli\u003eDo not conduct tests that will impact the performance of the environment\u003c/li\u003e\n\u003cli\u003eIf you feel you have found a security issue, but testing will impact the environment, please submit the issue and contact support@bugcrowd.com\u003c/li\u003e\n\u003cli\u003eThis is a production site, so please avoid copious amounts of scanner activity\u003c/li\u003e\n\u003cli\u003eIf your IP address gets banned for excessive scanning, please wait 4 hours to be unbanned, if you still experience issues please email support@bugcrowd.com\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eMobile Downloads\u003c/em\u003e\u003c/strong\u003e:\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eAndroid:\u003c/em\u003e \u003ca href=\"https://play.google.com/store/apps/details?id=com.overstock\u0026amp;pli=1\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://play.google.com/store/apps/details?id=com.overstock\u0026amp;pli=1\u003c/a\u003e\u003cbr\u003e\n\u003cem\u003eiOS:\u003c/em\u003e \u003ca href=\"https://apps.apple.com/us/app/overstock-com-mobile-shopping/id339883869\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://apps.apple.com/us/app/overstock-com-mobile-shopping/id339883869\u003c/a\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease note, https://www.bedbathandbeyond.com/api, https://www.bedbathandbeyond.com/api2, and https://api.bedbathandbeyond.com are used frequently with both mobile apps.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eApplication logic issues\u003c/li\u003e\n\u003cli\u003eRemote Code Execution\u003c/li\u003e\n\u003cli\u003eSignificant Authentication Bypass\u003c/li\u003e\n\u003cli\u003eCross Site Request Forgery on Critical Actions\u003c/li\u003e\n\u003cli\u003eCross Site Scripting (excluding self-XSS)\u003c/li\u003e\n\u003cli\u003eSQL Injection\u003c/li\u003e\n\u003cli\u003eDirectory Traversal\u003c/li\u003e\n\u003cli\u003eInformation Disclosure\u003c/li\u003e\n\u003cli\u003eAPI abuse, especially against the following URIs:\n\n\u003cul\u003e\n\u003cli\u003ewww.bedbathandbeyond.com/api\u003c/li\u003e\n\u003cli\u003ewww.bedbathandbeyond.com/api2\u003c/li\u003e\n\u003cli\u003eapi.bedbathandbeyond.com/checkouts\u003c/li\u003e\n\u003cli\u003eapi.bedbathandbeyond.com/oauth\u003c/li\u003e\n\u003cli\u003eapi.bedbathandbeyond.com/emails\u003c/li\u003e\n\u003cli\u003eapi.bedbathandbeyond.com/bronze\u003c/li\u003e\n\u003cli\u003eapi.bedbathandbeyond.com/customers\u003c/li\u003e\n\u003cli\u003eapi.bedbathandbeyond.com/storecard\u003c/li\u003e\n\u003cli\u003eapi.bedbathandbeyond.com/wishlists\u003c/li\u003e\n\u003cli\u003eedge.supplieroasis.com/gateway\u003c/li\u003e\n\u003cli\u003eswarmshop.com\u003c/li\u003e\n\u003cli\u003e\u003cem\u003e.swarmshop.com/\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eapi.swarmshop.com\u003c/li\u003e\n\u003cli\u003ewww.swarmshop.com/\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Bed Bath and Beyond not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Bed Bath and Beyond, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation. \u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"1b1d9e05-2fc9-4750-be00-8e1b4385f7b7","name":"Bed Bath and Beyond","targets":[{"id":"a84c9e4a-254b-46ea-b08e-53cb53563197","uri":null,"name":"www.bedbathandbeyond.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"307a06fb-4e0c-4d54-8ad6-6b2e026bb314","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"a84c9e4a-254b-46ea-b08e-53cb53563197"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"a84c9e4a-254b-46ea-b08e-53cb53563197"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"a84c9e4a-254b-46ea-b08e-53cb53563197"},{"id":"9558d6b3-9880-4506-9e19-55dc1d7d8aff","name":"RequireJS","targetId":"a84c9e4a-254b-46ea-b08e-53cb53563197"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"a84c9e4a-254b-46ea-b08e-53cb53563197"},{"id":"9f26f47e-4acd-4d8d-aad2-414b6b367eb0","name":"Handlebars","targetId":"a84c9e4a-254b-46ea-b08e-53cb53563197"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"a84c9e4a-254b-46ea-b08e-53cb53563197"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a84c9e4a-254b-46ea-b08e-53cb53563197"}],"recentChangeFlags":null},{"id":"9f032490-849b-4c71-92ab-245fd82d32ee","uri":"https://*.bedbathandbeyond.com","name":"*.bedbathandbeyond.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c5bf4b5b-7966-4ffe-b5e1-3f3b7472d030","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"9f032490-849b-4c71-92ab-245fd82d32ee"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"9f032490-849b-4c71-92ab-245fd82d32ee"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"9f032490-849b-4c71-92ab-245fd82d32ee"},{"id":"9558d6b3-9880-4506-9e19-55dc1d7d8aff","name":"RequireJS","targetId":"9f032490-849b-4c71-92ab-245fd82d32ee"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"9f032490-849b-4c71-92ab-245fd82d32ee"},{"id":"9f26f47e-4acd-4d8d-aad2-414b6b367eb0","name":"Handlebars","targetId":"9f032490-849b-4c71-92ab-245fd82d32ee"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"9f032490-849b-4c71-92ab-245fd82d32ee"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9f032490-849b-4c71-92ab-245fd82d32ee"},{"id":"e591e8bc-d7f4-49ad-952f-98dee6c92653","name":"DNS","targetId":"9f032490-849b-4c71-92ab-245fd82d32ee"}],"recentChangeFlags":null},{"id":"d4cc8f7f-147f-4cf9-9629-514c358f7cb2","uri":"https://api.bedbathandbeyond.com","name":"http(s)://api.bedbathandbeyond.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"02daf650-1294-4c87-b111-f2005bc09ca5","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d4cc8f7f-147f-4cf9-9629-514c358f7cb2"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"d4cc8f7f-147f-4cf9-9629-514c358f7cb2"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"d4cc8f7f-147f-4cf9-9629-514c358f7cb2"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"d4cc8f7f-147f-4cf9-9629-514c358f7cb2"}],"recentChangeFlags":null},{"id":"0834de64-5225-492a-bc75-e6d8c20e27f3","uri":"https://play.google.com/store/apps/details?id=com.overstock\u0026hl=en_US ","name":"Bed Bath \u0026 Beyond Mobile App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9574d154-8032-4049-bb3c-b4d6af911472","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"0834de64-5225-492a-bc75-e6d8c20e27f3"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"0834de64-5225-492a-bc75-e6d8c20e27f3"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"0834de64-5225-492a-bc75-e6d8c20e27f3"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"0834de64-5225-492a-bc75-e6d8c20e27f3"}],"recentChangeFlags":null},{"id":"424f2949-e940-4791-a081-cda9e925245e","uri":"https://apps.apple.com/us/app/bed-bath-beyond/id339883869","name":"Bed Bath \u0026 Beyond iOS Mobile App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fbfae03e-e072-453e-8040-7569fa3fec79","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"424f2949-e940-4791-a081-cda9e925245e"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"424f2949-e940-4791-a081-cda9e925245e"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"424f2949-e940-4791-a081-cda9e925245e"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"424f2949-e940-4791-a081-cda9e925245e"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"424f2949-e940-4791-a081-cda9e925245e"}],"recentChangeFlags":null},{"id":"73236984-04c4-48a2-b327-b70e0019ebfd","uri":"https://edge.supplieroasis.com","name":"http(s)://edge.supplieroasis.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a7c4f183-e688-4758-8b5d-3d30ad175c71","sortOrder":0},"sortOrder":0,"tags":[{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"73236984-04c4-48a2-b327-b70e0019ebfd"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"73236984-04c4-48a2-b327-b70e0019ebfd"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"73236984-04c4-48a2-b327-b70e0019ebfd"}],"recentChangeFlags":null},{"id":"66fcc95f-52bd-4ecc-962a-3246317c69e0","uri":"https://*.supplieroasis.com","name":"*.supplieroasis.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"762f73b0-7607-45e1-8fea-2840fc6d1c82","sortOrder":0},"sortOrder":0,"tags":[{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"66fcc95f-52bd-4ecc-962a-3246317c69e0"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"66fcc95f-52bd-4ecc-962a-3246317c69e0"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"66fcc95f-52bd-4ecc-962a-3246317c69e0"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"c149f27e-cfb4-4df2-ac16-646318471441","name":"Out of Scope","targets":[{"id":"4050fb5b-fd8d-45b3-a8bc-7ab38707382f","uri":null,"name":"investors.overstock.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5f54cdc9-d4f7-4d4f-9ff1-d921e292f314","sortOrder":0},"sortOrder":0,"tags":[{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"4050fb5b-fd8d-45b3-a8bc-7ab38707382f"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"4050fb5b-fd8d-45b3-a8bc-7ab38707382f"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"4050fb5b-fd8d-45b3-a8bc-7ab38707382f"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"4050fb5b-fd8d-45b3-a8bc-7ab38707382f"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"4050fb5b-fd8d-45b3-a8bc-7ab38707382f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4050fb5b-fd8d-45b3-a8bc-7ab38707382f"}],"recentChangeFlags":null},{"id":"e9fba63f-19f5-4101-bc72-899276bf2085","uri":null,"name":"help.overstock.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7aa7a2c2-3750-4109-90fc-20c5a53fc2f9","sortOrder":0},"sortOrder":0,"tags":[{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"e9fba63f-19f5-4101-bc72-899276bf2085"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e9fba63f-19f5-4101-bc72-899276bf2085"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"5ecf8a9d-cb5f-4b6a-86e2-4aa8b65d77e9","code":"overstockvdp","state":"in_progress","endsAt":null,"bountyId":"49b293f5-be42-43cc-9145-01158a164a24","startsAt":"2018-06-28T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"eCommerce","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/1fc4/0cdf/97a13635/63cb19237db98bd2b52f3a273a70dff6_BBB_stacked_logo.jpg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2018-06-28T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/overstockvdp","changelogs":"/engagements/overstockvdp/changelog","submissions":null,"announcements":"/engagements/overstockvdp/announcements","hallOfFame":"/engagements/overstockvdp/hall_of_fames","crowdstream":"/engagements/overstockvdp/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/overstockvdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=overstockvdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/overstockvdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/overstockvdp/changelog","publishedAt":"2026-07-03T20:46:38.341Z","engagementChangelogUrl":"/engagements/overstockvdp/changelog/1eb84c9b-169a-4ad9-b1d0-968300dd321d","createUserFeedbacksUrl":"/engagements/overstockvdp/feedbacks","engagementCrowdstreamUrl":"/engagements/overstockvdp/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}