{"id":"80d0d164-dc93-4e80-a266-3e2c86ae100c","engagementId":"1ef35772-3878-4c23-bc85-94dee7939af5","data":{"brief":{"id":"2405e801-e313-4917-b777-da0b999babe3","name":"Royal Automotive Club of Victoria (RACV) Vulnerability Disclosure Engagement","tagline":"RACV has been one of Australia's most trusted brands and is the largest member organisation in Victoria. Please submit your findings to this Vulnerability Disclosure Engagement.","description":"\u003cp\u003eRACV is proud to provide exceptional experiences for our members and customers through a range of products and services across motoring and mobility, home, energy and leisure. These include emergency roadside assistance, motor insurance, home insurance, home trades and an increasing range of options in the cleaner energy space, such as RACV Solar.\u003c/p\u003e\n\n\u003cp\u003eWe have 10 clubs and resorts across Australia and a range of domestic and international holiday packages, tours and cruises from our trusted travel partners.\u003c/p\u003e\n\n\u003cp\u003eWe're looking for passionate and driven researchers who are excited to join us in our pursuit of securing our assets.\u003c/p\u003e\n\n\u003cp\u003eGood luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"84de63c9-6091-4b30-a36e-d55632cb0f0b","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of RACV not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to RACV, you can report it to our vulnerability disclosure program. However, be aware that such reports will be ineligible for rewards or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eAll of the in scope targets are public facing and do not require any additional steps to access.\u003c/p\u003e\n\n\u003ch3\u003eCredentials\u003c/h3\u003e\n\n\u003cp\u003eCurrently, the in-scope targets do not require credentials. Please do not create credentials at this time as you will be testing on an out of scope asset.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eOWASP Top Ten Vulnerabilities for \u003ca href=\"https://owasp.org/www-project-top-ten/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eWeb\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eExposure of customer financial data and PII\u003c/li\u003e\n\u003cli\u003eServer Security Misconfiguration\u003c/li\u003e\n\u003cli\u003eCryptographic Weakness\u003cbr\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eSubdomain takeovers\u003c/li\u003e\n\u003cli\u003eRate limiting issues (Dos/DDoS etc.)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eN-Day Policy:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eWhen N-Day bugs are released to the public, we will consider these as in scope \u003cem\u003eafter\u003c/em\u003e 45 days have gone by\n\n\u003cul\u003e\n\u003cli\u003ee.g: N-day released on 01/01/2024, we would consider it in-scope on 02/15/2024\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease do not submit forms that may trigger contact with RACV staff.\u003c/li\u003e\n\u003cli\u003eAny of our support or contact forms \u003c/li\u003e\n\u003cli\u003eSocial Engineering and any interaction with RACV physical locations, employees and customers.\u003c/li\u003e\n\u003cli\u003eBest practice or informational security advice \u003c/li\u003e\n\u003cli\u003eData Exfiltration Limits: Do not exfiltrate bulk data. Researchers must provide only a minimal data sample (Proof of Concept) sufficient to demonstrate the vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eLeaked Credentials\u003c/h2\u003e\n\n\u003cp\u003eIf you happen to identify vulnerabilities involving data that has been exposed or leaked such as dark web forums or leaked credential sites. You can report it to this engagement. However, be aware that it is only eligible for points-based compensation. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd support portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"2fd234c3-a445-4c67-b363-28d65e006b42","name":"Royal Automotive Club of Victoria (RACV) - In scope ","targets":[{"id":"04f5f81c-3ebd-466c-862c-f6c12a44b680","uri":"https://racv.com.au","name":"https://www.racv.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"84755980-2d60-4580-aa31-4c1dbff8faa8","sortOrder":0},"sortOrder":0,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"04f5f81c-3ebd-466c-862c-f6c12a44b680"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"04f5f81c-3ebd-466c-862c-f6c12a44b680"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"04f5f81c-3ebd-466c-862c-f6c12a44b680"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"04f5f81c-3ebd-466c-862c-f6c12a44b680"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"04f5f81c-3ebd-466c-862c-f6c12a44b680"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"04f5f81c-3ebd-466c-862c-f6c12a44b680"}],"recentChangeFlags":null},{"id":"bfbbd90a-95aa-467c-94e2-50c96b8a4a45","uri":"https://bourkestreetgreen.com.au","name":"https://www.bourkestreetgreen.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e44f36cf-a24a-49eb-8c88-17d80c6fd0e6","sortOrder":1},"sortOrder":1,"tags":[{"id":"187a0132-af2c-45e1-b4af-77ac6117b9dc","name":"Adobe Experience Manager","targetId":"bfbbd90a-95aa-467c-94e2-50c96b8a4a45"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"bfbbd90a-95aa-467c-94e2-50c96b8a4a45"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"bfbbd90a-95aa-467c-94e2-50c96b8a4a45"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bfbbd90a-95aa-467c-94e2-50c96b8a4a45"}],"recentChangeFlags":null},{"id":"aae480eb-65ae-4638-9d32-a2962083b8d1","uri":"https://arevo.com.au","name":"https://arevo.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"906b1e60-cfb0-486c-ab38-f4e55c5b93c7","sortOrder":2},"sortOrder":2,"tags":[{"id":"2bf483dc-2f0b-4e2d-b7f0-568b8cc28809","name":"Transportation","targetId":"aae480eb-65ae-4638-9d32-a2962083b8d1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"aae480eb-65ae-4638-9d32-a2962083b8d1"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"8f24917d-e224-4554-9ee6-3fa102da1cd0","name":"Out of Scope","targets":[{"id":"1d0b5f6e-1e84-4225-b021-2cbeb72a6454","uri":"","name":" *.racv.com.au ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3884a901-7389-4a5c-82f1-732621c57adb","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1d0b5f6e-1e84-4225-b021-2cbeb72a6454"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"1ef35772-3878-4c23-bc85-94dee7939af5","code":"racv-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"dd2168b3-4ffa-4a2c-8664-cf1451ad0585","startsAt":"2024-12-10T17:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Automotive","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/70c1/6cbe/30f6597e/25c9142b46b459dacde7429ede4e219f_racv_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-12-10T17:00:00.041Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/racv-vdp-pro","changelogs":"/engagements/racv-vdp-pro/changelog","submissions":null,"announcements":"/engagements/racv-vdp-pro/announcements","hallOfFame":"/engagements/racv-vdp-pro/hall_of_fames","crowdstream":"/engagements/racv-vdp-pro/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/racv-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=racv-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/racv-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/racv-vdp-pro/changelog","publishedAt":"2026-08-11T07:12:44.650Z","engagementChangelogUrl":"/engagements/racv-vdp-pro/changelog/80d0d164-dc93-4e80-a266-3e2c86ae100c","createUserFeedbacksUrl":"/engagements/racv-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/racv-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}