{"id":"ccaee612-9c28-4370-bd5b-646888e30b5e","engagementId":"1c5c7981-df0e-4a8c-bf78-d374e4776cb1","data":{"brief":{"id":"4234ec87-4071-47fa-b4a8-1b4f2807a619","name":"Progress Software – Podio","tagline":"Dedicated to propelling business forward in a technology-driven world, Progress (Nasdaq: PRGS) helps businesses drive faster cycles of innovation, fuel momentum and accelerate their path to success","description":"\u003cp\u003eNo technology is perfect and Progress Software believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our application. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Progress Software not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Progress Software, you can report it via our \u003ca href=\"https://www.progress.com/security/vulnerability-reporting-policy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eVulnerability Disclosure Program\u003c/a\u003e. The following guidelines are to be adhered to at all times:\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eThe use of Automated scanners against public websites is strictly prohibited\u003c/strong\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003ch3\u003eOut of scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://developers.podio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developers.podio.com\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://status.podio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://status.podio.com\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://help.podio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://help.podio.com\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClickjacking on pages with no sensitive actions\u003c/li\u003e\n\u003cli\u003eCross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\u003c/li\u003e\n\u003cli\u003eAttacks requiring MITM or physical access to a user's device.\u003c/li\u003e\n\u003cli\u003ePreviously known vulnerable libraries without a working Proof of Concept.\u003c/li\u003e\n\u003cli\u003eComma Separated Values (CSV) injection without demonstrating a vulnerability.\u003c/li\u003e\n\u003cli\u003eMissing best practices in SSL/TLS configuration.\u003c/li\u003e\n\u003cli\u003eAny activity that could lead to the disruption of our service (DoS).\u003c/li\u003e\n\u003cli\u003eContent spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\u003c/li\u003e\n\u003cli\u003eRate limiting or bruteforce issues on non-authentication endpoints\u003c/li\u003e\n\u003cli\u003eMissing best practices in Content Security Policy.\u003c/li\u003e\n\u003cli\u003eMissing HttpOnly or Secure flags on cookies\u003c/li\u003e\n\u003cli\u003eMissing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\u003c/li\u003e\n\u003cli\u003eVulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]\u003c/li\u003e\n\u003cli\u003eSoftware version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\u003c/li\u003e\n\u003cli\u003eTabnabbing\u003c/li\u003e\n\u003cli\u003eOpen redirect - unless an additional security impact can be demonstrated\u003c/li\u003e\n\u003cli\u003eIssues that require unlikely user interaction\u003c/li\u003e\n\u003cli\u003ePhishing customers or employees of Progress Software. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eDisclosure Policy\u003c/h2\u003e\n\n\u003cp\u003ePlease do not discuss any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003cli\u003eProgress employees, Progress contractors, or Progress suppliers may not submit to this program.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"ef858132-34c9-4156-9995-67fe1dcc31fb","name":"Podio Web Applications","targets":[{"id":"cdd7b56e-0c1f-4211-992b-5bd9420ad5e4","uri":"https://www.podio.com","name":"Podio","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7ff61771-2c86-4894-aa0b-92fdb32de541","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"f543b986-0071-4f72-a36b-cd41ad73d5ab","uri":"https://apps.apple.com/us/app/podio/id404183617","name":"Podio iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c0ef4450-aaa2-4f3e-adef-138a098d026f","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"10ecf9f9-64fd-413b-934d-c33b3d2c8d54","uri":"https://play.google.com/store/apps/details?id=com.podio","name":"Podio Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3d225e53-8547-43b2-81df-43c31b05a78f","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"114e8c9a-aff7-4a9e-93fa-a7c9f52987b5","uri":"https://workflow-automation.podio.com/","name":"Podio Workflow Automation","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"61b1a633-9a7d-4867-9700-8f7e9de52c93","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003e\u003ca href=\"https://www.podio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ePodio\u003c/a\u003e\u003cbr\u003e\nPodio is an innovative all-in-one platform that revolutionizes work management and team collaboration. It serves as a customizable digital workspace where teams can build no-code apps to organize content, structure and automate business processes, assign tasks, and collaborate efficiently, thereby, boosting work productivity. \u003ca href=\"https://podio.com/signup\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSignUp\u003c/a\u003e for your free account and start exploring with help from our \u003ca href=\"https://docs.sharefile.com/en-us/podio/getting-started/getting-started\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGetting Started\u003c/a\u003e article.\u003c/p\u003e\n\n\u003cp\u003e\u003ca href=\"https://workflow-automation.podio.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ePodio Workflow Automation\u003c/a\u003e\u003cbr\u003e\nPodio Workflow Automation enables users to automate repetitive tasks and optimize business processes effortlessly, without complex coding. With numerous built-in rules and triggers, it executes time-sensitive actions automatically, saving time and money, reducing manual errors, and enhancing the efficiency of business workflows. Podio Workflow Automation is only available to users on a \u003ca href=\"https://www.podio.com/site/pricing/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ePodio Premium plan\u003c/a\u003e. Once you’ve upgraded your Podio account to Premium, follow our \u003ca href=\"https://docs.sharefile.com/en-us/podio/using-podio/workflow-automation/getting-started\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGetting Started with Workflow Automation\u003c/a\u003e documentation to start building powerful automations.\u003c/p\u003e\n\n\u003ch3\u003eIn scope\u003c/h3\u003e\n\n\u003cp\u003ePodio\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://api.podio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://api.podio.com\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://files.podio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://files.podio.com\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://presence.podio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://presence.podio.com\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://push.podio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://push.podio.com\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003ePodio Workflow Automation\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://workflow-automation.podio.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://workflow-automation.podio.com\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"1c5c7981-df0e-4a8c-bf78-d374e4776cb1","code":"progress-podio-vdp","state":"in_progress","endsAt":null,"bountyId":"391fdae0-18ef-44d2-a507-46203d19d712","startsAt":"2025-04-22T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/0a47/2bae/506f5de9/889a0be43948ba11a67a6c1574c082fc_progress_software_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-04-22T18:00:00.020Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/progress-podio-vdp","changelogs":"/engagements/progress-podio-vdp/changelog","submissions":null,"announcements":"/engagements/progress-podio-vdp/announcements","hallOfFame":"/engagements/progress-podio-vdp/hall_of_fames","crowdstream":null},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Priority Triage","submitReportUrl":"/engagements/progress-podio-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=progress-podio-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/progress-podio-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/progress-podio-vdp/changelog","publishedAt":"2025-10-23T13:55:53.618Z","engagementChangelogUrl":"/engagements/progress-podio-vdp/changelog/ccaee612-9c28-4370-bd5b-646888e30b5e","createUserFeedbacksUrl":"/engagements/progress-podio-vdp/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}