{"id":"13fe5221-e7f6-4843-8d53-9b59e2ec584b","engagementId":"9f1f2fcb-920c-464a-99dc-a0928d8617ef","data":{"brief":{"id":"423adbad-1d11-4ad6-a1c9-f3eed367ba52","name":"Empower Personal Wealth","tagline":"Financial Software and Wealth Management","description":"\u003cp\u003eHere at Empower, we believe in the power of technology to change the financial industry, making it more accessible, affordable, and honest. And we believe in the power of people to change the nature of investment advice, making it more transparent, objective, and personal. We are building a better money management experience for everyone with technology. \u003c/p\u003e\n\n\u003cp\u003eYour mission, researcher, should you choose to accept it is to help to ensure that our front end web application stack and back-end API endpoints are tough as nails. Nobody wants their favorite money management app to leak sensitive data out.\u003c/p\u003e\n\n\u003cp\u003eThe Empower Personal Wealth web application is an HTML5 web app using single-page design and using  Backbone, React and Angular for rendering web content. The application calls our backend RESTful APIs, written in Java with Spring MVC and JPA. We use RDBMS for persistent storage. You are welcome to stalk our engineering blog for further insights. While we are not providing researchers with the full list of all of our APIs, we do want to help researchers out. If you think you are onto something but just need a bit more information on a specific API, let us know!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this Bug Bounty Program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher along with the opportunity to appeal and make a case for a higher priority. Please see below for deviations.\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003cp\u003e\u003cstrong\u003eTesting is only authorized on the targets listed as In-Scope. \u003cem\u003eAny domain/property of Empower not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e If you believe you've identified a vulnerability on a system outside the scope, please reach out to support@bugcrowd.com before submitting.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003ePlease also note that we will have a testing blackout Thursdays between 12:00 pm and 4:00 pm Pacific Time when we refresh the environment.\u003c/em\u003e\u003c/strong\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eFocus Areas\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003eServer-side APIs are the number one focus area for this program\u003c/li\u003e\n\u003cli\u003eSubverting user authentication completely or partly (e.g.: including MFA)\u003c/li\u003e\n\u003cli\u003eUser information PII or financial information disclosure\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003eCredentials and Access\u003c/h1\u003e\n\n\u003cp\u003eThings that will help you play with things:\u003c/p\u003e\n\n\u003ch2\u003eKey URLs:\u003c/h2\u003e\n\n\u003cp\u003eRegistration - \u003ca href=\"https://devstaging.pcapcloud.com/page/login/registerUser\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://devstaging.pcapcloud.com/page/login/registerUser\u003c/a\u003e\u003cbr\u003e\nLogin Page - \u003ca href=\"https://devstaging.pcapcloud.com/page/login/goHome\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://devstaging.pcapcloud.com/page/login/goHome\u003c/a\u003e\u003c/p\u003e\n\n\u003ch2\u003eCredentials:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAnyone is free to create their own accounts on our platform through the registration page we ask that you use your @bugcrowdninja.com email for this purpose.\u003c/li\u003e\n\u003cli\u003eMany authentication scenarios will require you to submit through MFA. You are welcome to use either your personal phone or procure a VOIP number for this purpose.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eFinancial Institution Aggregation\u003c/h3\u003e\n\n\u003cp\u003eTo fully test the dashboard and many of the interfaces available in our platform you will need financial institutions accounts linked. For this purpose, this environment makes available a test institution. Link it as follows:\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003eClick on “link account” and locate “Dag Site”\u003c/li\u003e\n\u003cli\u003eUnder “Catalog” enter ID pcap.site16441.3\u003c/li\u003e\n\u003cli\u003eUnder “Password” enter Password site16441.3\u003c/li\u003e\n\u003cli\u003eClick “I’m done linking accounts”\u003c/li\u003e\n\u003cli\u003eFeel free to also link your own personal accounts should you so desire :)\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003ch2\u003eEmpower Personal Cash testing (Featuring Joint Accounts!):\u003c/h2\u003e\n\n\u003cp\u003eTo get to Empower Personal Cash feature, navigate to the \"Banking\" tab in your Dashboard and then select \"Open an Account\". A most interesting feature that we'd like your help to test are the joint account invite / authentication flows.\u003c/p\u003e\n\n\u003cp\u003eA couple notes on making it through the flow:\u003cbr\u003e\nOn the page that asks for “State ID Number”, please generate a random number (if the same number is used by two testers, it will lock the enrollment flow for the user)\u003cbr\u003e\nOn the Identity Verification Questions, only select the last answer (this will usually be the “none of the above” answer\u003cbr\u003e\n\u003cstrong\u003eIf testing the joint account flow, be sure to provide a different email address (using a email+foobar@domain.com will suffice) for the delegated account\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eBelow are some fake test identities that should allow you to progress through the account opening flow to test for vulnerabilities. \u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eFirst Name \u0026amp; Middle Initial\u003c/th\u003e\n\u003cth\u003eLast Name\u003c/th\u003e\n\u003cth\u003eSSN\u003c/th\u003e\n\u003cth\u003eDOB\u003c/th\u003e\n\u003cth\u003eHome Phone\u003c/th\u003e\n\u003cth\u003eAddress\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eLawrence J.\u003c/td\u003e\n\u003ctd\u003eAber\u003c/td\u003e\n\u003ctd\u003e666661234\u003c/td\u003e\n\u003ctd\u003e5/1/1978\u003c/td\u003e\n\u003ctd\u003e8645824068\u003c/td\u003e\n\u003ctd\u003e8101 W Flamingo Rd Las Vegas NV 89147\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eJanet A.\u003c/td\u003e\n\u003ctd\u003eBusch\u003c/td\u003e\n\u003ctd\u003e666822043\u003c/td\u003e\n\u003ctd\u003e7/5/1975\u003c/td\u003e\n\u003ctd\u003e3129850020\u003c/td\u003e\n\u003ctd\u003e4227 N 27th Av   #3017 Phoenix AZ 85017\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eAziz\u003c/td\u003e\n\u003ctd\u003eAbdullah\u003c/td\u003e\n\u003ctd\u003e666822882\u003c/td\u003e\n\u003ctd\u003e1/1/1951\u003c/td\u003e\n\u003ctd\u003e3129850099\u003c/td\u003e\n\u003ctd\u003e1001 Riverland Woods Charleston SC 29412\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eKim\u003c/td\u003e\n\u003ctd\u003eStatesman\u003c/td\u003e\n\u003ctd\u003e666121819\u003c/td\u003e\n\u003ctd\u003e10/1/1981\u003c/td\u003e\n\u003ctd\u003e8885550001\u003c/td\u003e\n\u003ctd\u003e677 Integon Clinton SC 29325\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eJose\u003c/td\u003e\n\u003ctd\u003eAlvarez\u003c/td\u003e\n\u003ctd\u003e666101110\u003c/td\u003e\n\u003ctd\u003e10/1/1981\u003c/td\u003e\n\u003ctd\u003e3129850022\u003c/td\u003e\n\u003ctd\u003e117 Hamilton Rd Sterling VA 20165\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eJessica\u003c/td\u003e\n\u003ctd\u003eLeete\u003c/td\u003e\n\u003ctd\u003e666224124\u003c/td\u003e\n\u003ctd\u003e11/1/1942\u003c/td\u003e\n\u003ctd\u003e3129850024\u003c/td\u003e\n\u003ctd\u003e10813 Eagle Nest Rd Ocean Springs MS 39564\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eMike WA.\u003c/td\u003e\n\u003ctd\u003eMechanicsburg\u003c/td\u003e\n\u003ctd\u003e666010236\u003c/td\u003e\n\u003ctd\u003e10/1/1981\u003c/td\u003e\n\u003ctd\u003e3129850026\u003c/td\u003e\n\u003ctd\u003e3855 75th Rd Kirkland WA 98034\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eErnie\u003c/td\u003e\n\u003ctd\u003eMcCracken\u003c/td\u003e\n\u003ctd\u003e666105556\u003c/td\u003e\n\u003ctd\u003e3/1/1988\u003c/td\u003e\n\u003ctd\u003e3129850020\u003c/td\u003e\n\u003ctd\u003e300 Davidson Rd #4E Somerset NJ 08873\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eRobert\u003c/td\u003e\n\u003ctd\u003eCagle\u003c/td\u003e\n\u003ctd\u003e666783615\u003c/td\u003e\n\u003ctd\u003e2/24/1986\u003c/td\u003e\n\u003ctd\u003e3129850030\u003c/td\u003e\n\u003ctd\u003e1700 W Warlow Dr #202 Gillette WY 82716\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eKnown Issues\u003c/h1\u003e\n\n\u003cp\u003eThe following are either known issues we don't want to fix or already known and pending.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eUser enumeration from login page - That's a design decision.\u003c/li\u003e\n\u003cli\u003eNo DMARC on the devstaging domain - This domain isn’t used for mail as such this is a non-issue\u003c/li\u003e\n\u003cli\u003eSession invalidation on Password Reset \u0026amp; Change - We're aware of this.\u003c/li\u003e\n\u003cli\u003eContent Security Policy / Clickjacking - We’re aware of this.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003eExclusions\u003c/h1\u003e\n\n\u003cp\u003eThings you shouldn’t play with:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny denial of service type attacks (either network, resource exhaustion or anything else)\u003c/li\u003e\n\u003cli\u003eUser and email enumeration - we are aware and allow this intentionally. There are some throttling triggers to manage this risk so no need to lock yourself out\u003c/li\u003e\n\u003cli\u003eAny attack or vulnerability that hinges on a user’s computer being first compromised\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eIf you find a vulnerability, do not test on our live systems (out of scope as per above) to demonstrate it. The researcher's environment is an exact replica, demonstrating in this environment is sufficient.\u003c/strong\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eVRT Deviations\u003c/h2\u003e\n\n\u003cp\u003ePlease see below for deviations from the standard VRT.\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003ePRIORITY ▼\u003c/th\u003e\n\u003cth\u003eBUGCROWD CATEGORIES\u003c/th\u003e\n\u003cth\u003eSPECIFIC VULNERABILITY NAME\u003c/th\u003e\n\u003cth\u003eVARIANT OR AFFECTED FUNCTION\u003c/th\u003e\n\u003cth\u003eDEVIATION\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eP1\u003c/td\u003e\n\u003ctd\u003eServer Security Misconfiguration\u003c/td\u003e\n\u003ctd\u003eUsing Default Credentials\u003c/td\u003e\n\u003ctd\u003eProduction Server\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003ctd\u003eServer Security Misconfiguration\u003c/td\u003e\n\u003ctd\u003eMisconfigured DNS\u003c/td\u003e\n\u003ctd\u003eSubdomain Takeover\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003eServer Security Misconfiguration\u003c/td\u003e\n\u003ctd\u003eMail Server Misconfiguration\u003c/td\u003e\n\u003ctd\u003eMissing SPF on Email Domain\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003eServer Security Misconfiguration\u003c/td\u003e\n\u003ctd\u003eMail Server Misconfiguration\u003c/td\u003e\n\u003ctd\u003eEmail Spoofable Via Third-Party API Misconfiguration\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003eSensitive Data Exposure\u003c/td\u003e\n\u003ctd\u003eEXIF Geolocation Data Not Stripped From Uploaded Images\u003c/td\u003e\n\u003ctd\u003eAutomatic User Enumeration\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003eApplication-Level Denial-of-Service (DoS)\u003c/td\u003e\n\u003ctd\u003eHigh Impact and/or Medium Difficulty\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003eInsufficient Security Configurability\u003c/td\u003e\n\u003ctd\u003eWeak Password Policy\u003c/td\u003e\n\u003ctd\u003eComplexity, Both Length and Char Type Not Enforced\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eServer Security Misconfiguration\u003c/td\u003e\n\u003ctd\u003eNo Rate Limiting on Form\u003c/td\u003e\n\u003ctd\u003eRegistration\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eServer Security Misconfiguration\u003c/td\u003e\n\u003ctd\u003eNo Rate Limiting on Form\u003c/td\u003e\n\u003ctd\u003eEmail-Triggering\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eServer Security Misconfiguration\u003c/td\u003e\n\u003ctd\u003eMissing Secure or HTTP Only Cookie Flag\u003c/td\u003e\n\u003ctd\u003eSession Token\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eSensitive Data Exposure\u003c/td\u003e\n\u003ctd\u003eEXIF Geolocation Data Not Stripped From Uploaded Images\u003c/td\u003e\n\u003ctd\u003eManual User Enumeration\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eMissing Function Level Access Control\u003c/td\u003e\n\u003ctd\u003eUsername Enumeration\u003c/td\u003e\n\u003ctd\u003eData Leak\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eInsufficient Security Configurability\u003c/td\u003e\n\u003ctd\u003eWeak Password Policy\u003c/td\u003e\n\u003ctd\u003eComplexity, Char Type Not Enforced\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eInsecure Data Storage\u003c/td\u003e\n\u003ctd\u003eCredentials Stored Unencrypted\u003c/td\u003e\n\u003ctd\u003eOn External Storage\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eInsecure Data Storage\u003c/td\u003e\n\u003ctd\u003eSensitive Application Data Stored Unencrypted\u003c/td\u003e\n\u003ctd\u003eOn External Storage\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003ePrivacy Concerns\u003c/td\u003e\n\u003ctd\u003eUnnecessary Data Collection\u003c/td\u003e\n\u003ctd\u003eWiFi SSID+Password\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"c30253ec-0cb2-4a33-a698-051412f19d76","name":"███████████████","targets":[{"id":"2c95caf7-dcdb-4697-b50c-b170687f410f","uri":null,"name":"██████████████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"384a794d-b012-439c-9fe7-6e27e9ecae42","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"2c95caf7-dcdb-4697-b50c-b170687f410f"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"2c95caf7-dcdb-4697-b50c-b170687f410f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2c95caf7-dcdb-4697-b50c-b170687f410f"},{"id":"d58504e3-97f9-45ef-95aa-4a413a07190c","name":"Static Code Analysis","targetId":"2c95caf7-dcdb-4697-b50c-b170687f410f"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"2c95caf7-dcdb-4697-b50c-b170687f410f"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"3701031d-4db9-4103-9c05-6b137a996e42","p1MaxCents":400000,"p1MinCents":300000,"p2MaxCents":200000,"p2MinCents":120000,"p3MaxCents":70000,"p3MinCents":55000,"p4MaxCents":25000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████","rewardRangeData":{"1":{"min":3000,"max":4000},"2":{"min":1200,"max":2000},"3":{"min":550,"max":700},"4":{"min":150,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"d4b566d5-a9c4-4b6e-bb9c-3104fc651c12","name":"████████████","targets":[{"id":"71c3e3cb-3c8a-4c42-9a4a-28096318d8b5","uri":null,"name":"████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d661d9dd-93a2-4906-8e0b-8dca9ce28a09","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"9e5527a1-a52e-4be7-a6f2-765844735cad","uri":null,"name":"█████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"afd77173-7617-4656-a101-355b5e0aca1b","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"3fccfc74-eee6-4f39-afbd-ee5a91343aee","uri":null,"name":"█████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"676da1e6-ecf0-4750-ab3d-9cea40ea31dd","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"52f7c461-b4a2-41a6-8a21-2a36bce2fead","uri":null,"name":"███████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2e75a8a6-4479-4447-a1eb-57f73e3af905","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"9f1f2fcb-920c-464a-99dc-a0928d8617ef","code":"personalcapital","state":"in_progress_paused","endsAt":null,"bountyId":"bd2cdb0f-80c0-447e-bfe5-8ee6473edf58","startsAt":"2017-08-17T15:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/aa6e/1ddd/b355d142/98e1c38516319953f2b1bce945ecc7fb_EMP_bugcrowd.png","logoBackgroundColor":"#FFFFFF","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":"Pausing for program revamp","lastTransitionAt":"2026-04-08T18:21:33.089Z","cancellationReason":null,"statusLabel":"In progress paused","routesPaths":{"brief":"/engagements/personalcapital","changelogs":"/engagements/personalcapital/changelog","submissions":null,"announcements":"/engagements/personalcapital/announcements","hallOfFame":"/engagements/personalcapital/hall_of_fames","crowdstream":"/engagements/personalcapital/crowdstream"},"announcementsCount":15,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":null,"methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=personalcapital\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/personalcapital/engagement_subscribers","engagementChangelogsUrl":"/engagements/personalcapital/changelog","publishedAt":"2026-04-08T18:21:33.120Z","engagementChangelogUrl":"/engagements/personalcapital/changelog/13fe5221-e7f6-4843-8d53-9b59e2ec584b","createUserFeedbacksUrl":"/engagements/personalcapital/feedbacks","engagementCrowdstreamUrl":"/engagements/personalcapital/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}