{"id":"cfff090a-2481-4650-9298-62a652d14426","engagementId":"9c204a99-74a1-4734-a4ca-7b02ddb1d57a","data":{"brief":{"id":"64b250da-5ced-4f4c-a8eb-8a1b85c7de7e","name":"Petpooja Vulnerability Disclosure Program","tagline":"Help us identify and responsibly disclose security vulnerabilities in Petpooja products and services.","description":"\u003cp\u003ePetpooja is a software platform built to help restaurants and food-service businesses manage their day-to-day operations through an integrated suite of products and services.\u003c/p\u003e\n\n\u003ch2\u003eRatings \u0026amp; Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor initial prioritization and rating of submissions, this engagement uses the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eBugcrowd's initial priority may be adjusted based on the likelihood, exploitability, and potential impact of a vulnerability in the context of Petpooja's environment. Where a submission is downgraded, the researcher will receive an explanation and may appeal the priority decision through the Bugcrowd platform.\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cp\u003eTesting is authorized only against the targets explicitly listed in the \u003cstrong\u003eIn-Scope\u003c/strong\u003e target groups of this program. Assets that are not listed as in scope are not authorized for testing, even if they are owned, operated, or otherwise associated with Petpooja, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eEngagement Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eOriginal Research: Conduct meaningful, human-led analysis. Scanner-only or low-effort reports will be rejected.\u003c/li\u003e\n\u003cli\u003eSafety \u0026amp; Ethics: Respect production systems. Use minimal exploitation to prove impact, then stop. Do not impact availability, integrity, or confidentiality.\u003c/li\u003e\n\u003cli\u003eData Protection: Do not modify, delete, or access more user/customer data than necessary to demonstrate the vulnerability.\u003c/li\u003e\n\u003cli\u003eTesting Boundaries:\n-Do not conduct social engineering, phishing, or denial-of-service attacks.\n-Do not attack other researchers, employees, or third-party infrastructure.\n-Do not use compromised credentials or circumvent scope restrictions.\u003c/li\u003e\n\u003cli\u003eDestructive Vulnerabilities: Stop testing immediately and report if you discover potentially destructive issues (e.g., RCE, large-scale data exposure).\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003e- Privilege Escalation: Only permitted for validation; do not pivot, establish persistence, or access unrelated accounts.\u003c/h2\u003e\n\n\u003ch2\u003eReport Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eConsolidate Reports: Submit one report per underlying vulnerability. If the same issue affects multiple endpoints or environments, group them into a single report rather than submitting duplicates.\u003c/li\u003e\n\u003cli\u003eDetailed Reproduction: Include the account type used, affected target, clear description, impact, prerequisites, and step-by-step reproduction instructions.\u003c/li\u003e\n\u003cli\u003eEvidence of Impact: Do not submit theoretical scenarios or scanner-only output. You must demonstrate exploitability and clearly explain the security consequences and boundaries crossed.\u003c/li\u003e\n\u003cli\u003eData Hygiene: Avoid including sensitive information (PII, credentials, tokens) in reports. Redact where possible.\u003c/li\u003e\n\u003cli\u003eChained Vulnerabilities: You may chain vulnerabilities in a single report if necessary to demonstrate the full impact. Clearly define each link in the chain.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eAll targets within the published scope are publicly accessible from the internet.\u003c/p\u003e\n\n\u003ch2\u003eCredentials\u003c/h2\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here You may register for accounts here.\u003c/p\u003e\n\n\u003cp\u003ePlease note that all researchers are testing within the same environment - please do not modify or tamper with any account you do not expressly own.\u003c/p\u003e\n\n\u003cp\u003eYou have been provided a set of a pseudo-random @bugcrowdninja emails that have pre-provisioned accounts with access to the app - which, after accepting the engagement invite, will route all incoming traffic to the email associated with your Bugcrowd account. (see the bottom of this page for your specific assigned emails)\u003c/p\u003e\n\n\u003cp\u003eYou have been provisioned a set of two pseudo-random @bugcrowdninja emails that have been pre-provisioned accounts with access to the app - which, after accepting the engagement invite, will route all incoming traffic to the email associated with your Bugcrowd account. An invite to the application has been sent to each of these emails in advance and will be auto-forwarded upon accepting your invite to the engagement (see the bottom of this page for your specific assigned emails).\u003c/p\u003e\n\n\u003cp\u003eYou have been provided pre-provisioned accounts with access to the application. The credentials are available for retrieval at the bottom of the brief.\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cp\u003eTo support your testing, we’ve highlighted several key areas of interest. While we ask that you report any efforts related to these areas, please note that testing is not limited to them. Submissions outside of these focus areas are equally welcomed and appreciated.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthentication and authorization bypass vulnerabilities \u003c/li\u003e\n\u003cli\u003eAccount takeover scenarios \u003c/li\u003e\n\u003cli\u003ePrivilege escalation \u003c/li\u003e\n\u003cli\u003eExposure of sensitive customer, employee, or corporate data \u003c/li\u003e\n\u003cli\u003eAPI security weaknesses \u003c/li\u003e\n\u003cli\u003eRemote code execution vulnerabilities \u003c/li\u003e\n\u003cli\u003eBusiness logic flaws affecting e-commerce or customer workflows \u003c/li\u003e\n\u003cli\u003eSecurity misconfigurations in internet-facing assets \u003c/li\u003e\n\u003cli\u003eSession management and identity-related weaknesses \u003c/li\u003e\n\u003cli\u003eVulnerabilities that could impact payment-processing environments or customer privacy \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eN-day/Third party 0-day Policy\u003c/h2\u003e\n\n\u003cp\u003eWhen N-Day bugs are released to the public and can be exploited within our target(s), please let us know immediately. Each report will be reviewed on a case by case basis.\u003c/p\u003e\n\n\u003ch2\u003eLeaked Credentials\u003c/h2\u003e\n\n\u003cp\u003eSubmissions related to leaked or exposed employee credentials (e.g., dark web forums, credential dumps) will be reviewed on a case-by-case basis and may qualify for points-based compensation only. The use of any leaked credentials during testing is strictly prohibited and may result in disqualification from the bounty program.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eRestricted Targets: Only test explicitly listed in-scope assets. All other systems are unauthorized, including the petpooja.in root/subdomains, the Tasks application, staging/internal environments, and third-party infrastructure.\u003c/li\u003e\n\u003cli\u003eAvailability \u0026amp; Volumetric Testing: Do not perform DoS/DDoS, network or email flooding, rate limiting bypass, stress/load testing, or high-volume automated scanning and fuzzing.\u003c/li\u003e\n\u003cli\u003eSocial Engineering \u0026amp; Human Manipulation: Phishing, social engineering, pretexting, impersonation of employees or partners, and physical security testing are strictly prohibited.\u003c/li\u003e\n\u003cli\u003eData \u0026amp; System Integrity: Do not destroy or modify production data, perform bulk data extraction, or install malware, ransomware, backdoors, or persistence mechanisms.\u003c/li\u003e\n\u003cli\u003eAuthentication \u0026amp; Access: Do not use unauthorized credentials, API keys, or session tokens. Prohibited methods include brute-force, password spraying, and credential stuffing.\u003c/li\u003e\n\u003cli\u003eLow-Impact Submissions: Reports based solely on automated scanner output, vulnerabilities classified as P5, or issues in third-party services that lack a demonstrated security impact on Petpooja-controlled assets will not be accepted.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ch2\u003eSafe Harbor\u003c/h2\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003cbr\u003e\nLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via our \u003ca href=\"https://bugcrowd-support.freshdesk.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFreshdesk Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":"\u003ch2\u003eResponsible Disclosure\u003c/h2\u003e\n\n\u003cp\u003ePetpooja welcomes responsible security research that helps improve the security of its products and services.\u003c/p\u003e\n\n\u003cp\u003eResearchers are encouraged to provide clear, reproducible reports with sufficient technical detail to validate the reported vulnerability. Please avoid unnecessary access to, modification of, or retention of production data.\u003c/p\u003e\n\n\u003cp\u003eIf you encounter a vulnerability that could have a significant impact on the confidentiality, integrity, or availability of Petpooja systems or user data, stop testing once sufficient evidence has been obtained and report the issue.\u003c/p\u003e\n\n\u003cp\u003ePlease review the Scope Overview and target groups carefully before beginning testing. Only explicitly listed In-Scope targets are authorized for testing.\u003c/p\u003e"},"scope":[{"id":"f28e5cdf-f30e-48f6-ad8a-0b9b270157e7","name":"Web Applications \u0026 APIs","targets":[{"id":"afc37cf1-0268-4106-b6b9-7b73ea18cbad","uri":"https://*.petpooja.com/","name":"Petpooja Production Web Applications \u0026 APIs","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bb8ac7c5-4e61-48d2-bd62-c28e1dca6ab7","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"afc37cf1-0268-4106-b6b9-7b73ea18cbad"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"afc37cf1-0268-4106-b6b9-7b73ea18cbad"}],"recentChangeFlags":null},{"id":"a7ffc67b-157a-4b31-b686-0248b177fcc1","uri":"https://attendohr.com/","name":"AttendoHR","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0539cfea-e061-482f-9b5f-e23ae1a4c48b","sortOrder":1},"sortOrder":1,"tags":[{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"a7ffc67b-157a-4b31-b686-0248b177fcc1"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"a7ffc67b-157a-4b31-b686-0248b177fcc1"},{"id":"a634fd4f-7410-4f25-9d18-31f9ce752854","name":"CSS","targetId":"a7ffc67b-157a-4b31-b686-0248b177fcc1"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eWeb applications and APIs operated by Petpooja that are explicitly included in this program. Testing is authorized only against the listed target domains and services.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"ff74dc47-9349-495d-b4c2-d92d1f1dcd8e","name":"Mobile Applications","targets":[{"id":"44058028-49f4-45ff-a511-7d31327dbff5","uri":"https://play.google.com/store/apps/details?id=com.petpooja.employeepayroll","name":"Attendo: Employee","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9d4b20cd-a8c0-4be3-87da-3d45fc96f27a","sortOrder":0},"sortOrder":0,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"44058028-49f4-45ff-a511-7d31327dbff5"}],"recentChangeFlags":null},{"id":"e88d4c38-01eb-4957-b3d0-44b618bc7933","uri":"https://play.google.com/store/apps/details?id=com.petpooja.attendance","name":"Attendo: Admin","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1e2e1451-8219-4313-a712-8bcaa05244b1","sortOrder":1},"sortOrder":1,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"e88d4c38-01eb-4957-b3d0-44b618bc7933"}],"recentChangeFlags":null},{"id":"e759b894-8ac8-4ea7-81f3-c8510693959e","uri":"https://play.google.com/store/apps/details?id=com.petpooja.facerecognition","name":"Attendo: Face","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8b905491-fa2d-48fe-a747-b283cb395ea7","sortOrder":2},"sortOrder":2,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"e759b894-8ac8-4ea7-81f3-c8510693959e"}],"recentChangeFlags":null},{"id":"ec82a742-68cb-4bb5-a00e-468ba3859122","uri":"https://play.google.com/store/apps/details?id=com.petpooja.billing","name":"Petpooja - Merchant App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1d0cd303-127b-491f-be69-2d47befce734","sortOrder":3},"sortOrder":3,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"ec82a742-68cb-4bb5-a00e-468ba3859122"}],"recentChangeFlags":null},{"id":"cb6120b2-a1c5-486c-a5e5-781068ff45a6","uri":"https://play.google.com/store/apps/details?id=com.petpoojatrack.app","name":"Petpooja Track","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ef8d4f18-dc02-421a-8ecf-6dcdbe263778","sortOrder":4},"sortOrder":4,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"cb6120b2-a1c5-486c-a5e5-781068ff45a6"}],"recentChangeFlags":null},{"id":"1b11f30d-82a0-473c-9352-07e95d86fa3a","uri":"https://play.google.com/store/apps/details?id=com.petpooja.invoice","name":"Petpooja Invoice","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8db0cdf7-6b3a-41df-8d63-237484aed462","sortOrder":5},"sortOrder":5,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"1b11f30d-82a0-473c-9352-07e95d86fa3a"}],"recentChangeFlags":null},{"id":"ef1bad24-cbee-4459-935a-ce4ec3332c9d","uri":"https://play.google.com/store/apps/details?id=com.petpooja.retail_invoice","name":"Petpooja Invoice POS","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4496ed69-3634-4bf0-8ec0-495ff760d7ad","sortOrder":6},"sortOrder":6,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"ef1bad24-cbee-4459-935a-ce4ec3332c9d"}],"recentChangeFlags":null},{"id":"2eef7e95-701e-4056-9c00-eff78ce47c4c","uri":"https://play.google.com/store/apps/details?id=com.petpooja.purchase_manager","name":"Purchase Manager","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6bd7cd1f-a82c-4817-8244-30bcca1e8628","sortOrder":7},"sortOrder":7,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"2eef7e95-701e-4056-9c00-eff78ce47c4c"}],"recentChangeFlags":null},{"id":"da49e26b-f95a-4c49-83f8-7f442825cc91","uri":"https://play.google.com/store/apps/details?id=com.invoice.briefcase","name":"Purchase Scan","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"16e2bc2a-ff43-4272-9241-2dbc9613e243","sortOrder":8},"sortOrder":8,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"da49e26b-f95a-4c49-83f8-7f442825cc91"}],"recentChangeFlags":null},{"id":"7275247f-887a-4c17-b735-d4f77dca2ce9","uri":"https://play.google.com/store/apps/details?id=com.app.tvito","name":"Petpooja Marketing Hub","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c573a0dd-b83f-46b9-a3f6-e0360c57680f","sortOrder":9},"sortOrder":9,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"7275247f-887a-4c17-b735-d4f77dca2ce9"}],"recentChangeFlags":null},{"id":"b762cdbc-2531-4b99-a2aa-a98a462e17a1","uri":"https://apps.apple.com/in/app/petpooja-merchant-app/id1362012013","name":"Petpooja - Merchant App iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0e518e2e-68e8-4f6a-97e0-52ea9f522165","sortOrder":10},"sortOrder":10,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"b762cdbc-2531-4b99-a2aa-a98a462e17a1"}],"recentChangeFlags":null},{"id":"3eb5c259-5839-4388-8f5c-c253dd502ca2","uri":"https://apps.apple.com/in/app/petpooja-payroll-admin/id6478654383","name":"Attendo: Admin iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"351e9343-52b5-4312-8d57-ab89710d7964","sortOrder":11},"sortOrder":11,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"3eb5c259-5839-4388-8f5c-c253dd502ca2"}],"recentChangeFlags":null},{"id":"47981441-bb6e-41d2-a617-0792dbc023cd","uri":"https://apps.apple.com/in/app/petpooja-payroll-employee/id6499255254","name":"Attendo: Employee iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"64e880b9-460a-4288-a647-989da324af96","sortOrder":12},"sortOrder":12,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"47981441-bb6e-41d2-a617-0792dbc023cd"}],"recentChangeFlags":null},{"id":"083287a3-5657-4694-b1f4-de02913d07f0","uri":"https://apps.apple.com/in/app/petpooja-captain-app/id6470435905","name":"Petpooja Captain App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"656d5e99-e910-4b87-8c4f-005db53efc7e","sortOrder":13},"sortOrder":13,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"083287a3-5657-4694-b1f4-de02913d07f0"}],"recentChangeFlags":null},{"id":"fd8caafd-6317-4b1b-b987-ebcb2af2563a","uri":"https://apps.apple.com/in/app/petpooja-marketing-hub/id1621470378","name":"Petpooja Marketing Hub iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"949e6c0b-2339-4e6b-9a03-ec490751c457","sortOrder":14},"sortOrder":14,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"fd8caafd-6317-4b1b-b987-ebcb2af2563a"}],"recentChangeFlags":null},{"id":"83e295be-595b-4889-8c76-5727d3e7b752","uri":"https://apps.apple.com/in/app/petpooja-track-app/id6772917153","name":"Petpooja Track App iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0a939562-d812-45db-a63f-224813cc7608","sortOrder":15},"sortOrder":15,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"83e295be-595b-4889-8c76-5727d3e7b752"}],"recentChangeFlags":null},{"id":"f4f58d1f-8105-49e6-aad5-ecaeb093acaa","uri":"https://apps.apple.com/in/app/purchase-scan/id6740403231","name":"Petpooja Purchase Scan iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3bab3426-aad5-4c0e-9645-1a2131b6b494","sortOrder":16},"sortOrder":16,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"f4f58d1f-8105-49e6-aad5-ecaeb093acaa"}],"recentChangeFlags":null},{"id":"0a8cebe1-84f3-4fcd-854d-b9fff82c6ff4","uri":"https://apps.apple.com/in/app/purchase-manager-app/id6761174994","name":"Petpooja Purchase Manager App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"dff020a5-823a-42b6-be04-b8a3a3f06a0e","sortOrder":17},"sortOrder":17,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"0a8cebe1-84f3-4fcd-854d-b9fff82c6ff4"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eMobile applications operated by Petpooja and its affiliated products that are explicitly in scope. Testing is authorized only against the listed applications and associated services.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"02cde69a-764c-4e68-abb6-e004b3870f42","name":"Out of Scope","targets":[{"id":"7fc78e9b-001f-4160-a4e1-1644d6b7d148","uri":"https://tasksapi.petpooja.com/","name":"Tasks API","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"102afb5b-4ea9-45bd-a360-2dc8cfd3aa68","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"5fa0091f-f23c-4738-b4af-c13345317833","uri":"https://tasksstagingapi.petpooja.com/","name":"Tasks Staging API","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"35b19659-8509-4379-9728-b5bd97a819ca","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"8c66ed92-f669-4e64-ac83-74b9a179bf3d","uri":"https://tasksadmin.petpooja.com/","name":"Tasks Admin","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"995f5a56-8ae8-4204-bba8-69be5aa1abef","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"df0ea665-21ce-4d75-9828-3a3c605d63f7","uri":"https://tasksdashboard.petpooja.com/","name":"Tasks Dashboard","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8109ebfa-33cf-4e0b-9a92-a9c665e20468","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"8a4eacc4-1971-4cf8-a0b5-90c2e52594b2","uri":"https://play.google.com/store/apps/details?id=com.petpooja.task_manager","name":"Petpooja Tasks","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8fa5506e-63ea-45d2-b35a-dbc180f7bf63","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"f741971f-aaed-44da-a512-de3efa0b3f53","uri":"https://apps.apple.com/in/app/petpooja-tasks/id6479517350","name":"Petpooja Tasks iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a2faa412-0c00-40b6-8750-edce82bed305","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"e315e327-0128-478d-98ed-0db4731d6b96","uri":"https://*.petpooja.in/","name":"Petpooja .in Domains","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9bbcb179-2c21-4040-9b6e-b286126562a6","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"adb49a25-000a-4d9d-a5cc-9e136c44cda2","uri":"https://meta.petpooja.com","name":"Petpooja Meta","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0d62db3c-4a85-4b45-beb2-0bd2abaeaebc","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThe following Petpooja assets are explicitly excluded from this engagement and must not be tested.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"9c204a99-74a1-4734-a4ca-7b02ddb1d57a","code":"petpooja-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"9b7540ee-0e64-4b75-870d-fe5bcfe1cce8","startsAt":"2026-09-03T00:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/91d3/23f5/78052075/716789fbb581576ce5640aeb42ddfa1f_petpooja_prayosha_food_service_pvt_ltd__logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2026-09-03T00:00:00.034Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/petpooja-vdp-pro","changelogs":"/engagements/petpooja-vdp-pro/changelog","submissions":null,"announcements":"/engagements/petpooja-vdp-pro/announcements","hallOfFame":"/engagements/petpooja-vdp-pro/hall_of_fames","crowdstream":"/engagements/petpooja-vdp-pro/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/petpooja-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=petpooja-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/petpooja-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/petpooja-vdp-pro/changelog","publishedAt":"2026-09-03T12:25:04.411Z","engagementChangelogUrl":"/engagements/petpooja-vdp-pro/changelog/cfff090a-2481-4650-9298-62a652d14426","createUserFeedbacksUrl":"/engagements/petpooja-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/petpooja-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}