{"id":"74a53f5b-56a1-42b2-a54a-75d153060414","engagementId":"489ad4f5-e83e-4155-a17d-b628fff4d5c2","data":{"brief":{"id":"8895eda5-8faa-4afd-9497-8cd40019ffaf","name":"Rakuten Group, Inc. Vulnerability Disclosure Program","tagline":"Rakuten Group, Inc (TSE's first section:4755) is the largest ecommerce company in Japan, and third largest ecommerce marketplace company worldwide.","description":"\u003cp\u003eRakuten Group’s 70+ businesses span a broad range of online and offline services, including e-commerce, travel, digital content, fintech, such as credit cards, banking, securities, insurance, electronic money and smartphone app payments, communications, including a mobile carrier service, and professional sports. By linking these diverse services through a common membership and loyalty program, Rakuten has created one of the world’s most unique and robust ecosystems.\u003cbr\u003e\nRakuten collects publicly available vulnerability information daily and contacts the relevant security personnel, who are also members of Rakuten-CERT, about vulnerabilities that we believe must be addressed. Rakuten gives appropriate instructions on conducting investigations and how to act accordingly.\u003cbr\u003e\nPlease send your inquiries to Rakuten-CERT (\u003ca href=\"https://rakuten-cert@mail.rakuten.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003erakuten-cert@mail.rakuten.com\u003c/a\u003e) for other domains from \u003ca href=\"https://rakuten.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e.rakuten.com\u003c/a\u003e and \u003ca href=\"https://rakuten.co.jp\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e.rakuten.co.jp\u003c/a\u003e\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.\u003c/p\u003e","industryTagId":"1bf3970a-395b-4456-b261-d04dab482af2","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003ch3\u003eAccess:\u003c/h3\u003e\n\n\u003cp\u003eTargets are public-facing. \u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eYou are able to self-sign up for credentials. Please sign up for an account using your @bugcrowdninja.com email address, as they will be automatically approved and will allow for testing of all features without needing to make a payment. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRules:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eMakes sure no system is left in a more vulnerable state than you found it.\u003c/li\u003e\n\u003cli\u003ePlease refrain from any action that might be considered a privacy violation, cause the destruction of data, or interrupt or degrade our service.\n-Please do not submit contact forms, create support tickets, send emails, etc. that will generate work for a human outside of the security team. Use your @bugcrowdninja.com email if needed for research related work.\u003c/li\u003e\n\u003cli\u003eDo not modify, delete, destroy, or retain domain or customers' data.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eNon-qualifying submission:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eVolume related issues (e.g. brute force, rate limiting, DoS/DDoS).\u003c/li\u003e\n\u003cli\u003eAny attacks on our customers or end users\u003c/li\u003e\n\u003cli\u003eUsername/Email Enumeration via Login or Forgot Password error message\u003c/li\u003e\n\u003cli\u003eCSRF on forms that are available to anonymous users(such as Logout/Contact form)\u003c/li\u003e\n\u003cli\u003eUse stolen/breached user credentials.\u003c/li\u003e\n\u003cli\u003eSocial engineering, phishing, or physical testing (e.g. premises, equipment).\u003c/li\u003e\n\u003cli\u003eResearchers should not pursue post-exploitation unless explicitly approved.\u003c/li\u003e\n\u003cli\u003eAttacks against social media or third party services that Domain use (LinkedIn, Twitter, etc).\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting users of outdated browsers.\u003c/li\u003e\n\u003cli\u003eCookie flags, i.e. Secure, HTTPOnly.\u003c/li\u003e\n\u003cli\u003eAbsent or misconfigured HTTP headers, ie. Content-Security-Policy, Strict-Transport-Security, X-XSS-Protection, Cache-Control.\nClickjacking, i.e. missing X-Frame-Options header.\u003c/li\u003e\n\u003cli\u003eEmail configuration, e.g. SPF, DKIM, DMARC.\u003c/li\u003e\n\u003cli\u003eError pages, i.e. verbose error messages, stack traces, and invalid status codes.\u003c/li\u003e\n\u003cli\u003eFunctional, UI and UX bugs and spelling mistakes.\u003c/li\u003e\n\u003cli\u003eConfiguration that is not directly exploitable, ie. weak TLS ciphers, password policy, session expiration, certificate pinning, security headers divulging software version information, WordPress users, etc.\u003c/li\u003e\n\u003cli\u003eNo large scale, intrusive, or blind automated scanning.\u003c/li\u003e\n\u003cli\u003eNon-sensitive exposed API keys, e.g. Google Maps, Raygun.\u003c/li\u003e\n\u003cli\u003eGeneric vulnerability scan results without proof of concept or a clear path to exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eSafe Harbor:\u003c/h3\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via our \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003cem\u003esupport portal\u003c/em\u003e \u003c/a\u003e before going any further.\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"6e00cf65-2470-44f2-8402-d65e03ff65a3","name":"In Scope Target","targets":[{"id":"de122624-672a-49bc-878d-44ef3b53e99a","uri":"https://rakuten.com","name":"*.rakuten.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9e82e213-065d-4894-981e-9da47d4cc3d1","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"3db777b2-21a5-4fbf-9759-b90e146ebdf2","uri":"https://rakuten.co.jp","name":"*.rakuten.co.jp","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0db1a855-74cc-41d2-9d54-635cba0ea822","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"2e9e810d-5eef-4a7d-b7ed-87370a802070","uri":"https://rakuten-wallet.co.jp","name":"*.rakuten-wallet.co.jp","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a1a9c9b3-0f40-4974-b9be-4ad80206db3f","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"aca92b58-aa0b-4143-928a-0b816cd9ca73","uri":"https://www.rakuten-life.co.jp","name":"*.rakuten-life.co.jp","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7d0c8cd8-1fed-4334-997f-c624f60dfd43","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"90898d73-96b2-4d5c-8902-9168a74aefd1","uri":"https://rakuten-ssi.co.jp/","name":"*.rakuten-ssi.co.jp","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bfa8c71a-ad4e-456c-9b59-7e05a7150e15","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"095d5fcd-4488-4d57-b0bf-d7709f7fc425","uri":"https://rakuten-toushin.co.jp","name":"*.rakuten-toushin.co.jp","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4323bc04-66f5-46e4-8781-ef8b69b99993","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"ce7587aa-3eff-4892-a22e-501142c5da86","uri":"https://rakuten-sec.co.jp","name":"*.rakuten-sec.co.jp","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9ac76234-0083-4732-9106-b525a7dac36d","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"764f3053-fdf6-457d-aa8f-9f155bc10bcd","uri":"https://www.sec.rakuten.com.hk/","name":"*.sec.rakuten.com.hk","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0bf84580-4783-4b9a-b72a-d595311b07c1","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null},{"id":"999ced77-cf75-47ab-a7e8-acdfffa0528f","uri":"https://bullion.rakuten.com.hk","name":"*.bullion.rakuten.com.hk","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"31fa3aca-008d-4911-8381-1feb7181bf72","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null},{"id":"cbb3d9fd-ee7c-41d2-8793-072374a54e24","uri":"https://rakuten-card.co.jp","name":"*.rakuten-card.co.jp","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9ef31a12-5262-435e-831c-9f33b5962008","sortOrder":9},"sortOrder":9,"tags":null,"recentChangeFlags":null},{"id":"f19ab159-4e2b-4671-9d8a-cf29b385d678","uri":"https://*.rakuten-card.jp","name":"*.rakuten-card.jp","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1521df17-2e07-4dc7-b59a-94b8a1185f89","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null},{"id":"2ceee6c5-de85-4a64-b47b-c3a3b8f0bd98","uri":"https://www.card.rakuten.com.tw/","name":"*.card.rakuten.com.tw","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d0642495-2e3d-4fc6-9dd2-adf3eadc73d8","sortOrder":11},"sortOrder":11,"tags":null,"recentChangeFlags":null},{"id":"f916b792-56b0-4ce1-a263-95d3655eb740","uri":"https://www.rakuten-insurance.co.jp","name":"*.rakuten-insurance.co.jp","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"47001d42-e56c-4c49-a339-742f76013de6","sortOrder":12},"sortOrder":12,"tags":null,"recentChangeFlags":null},{"id":"baabc3a7-a81b-48f7-9da6-a42083f5e0ab","uri":"https://*.rakuten-bank.co.jp","name":"*.rakuten-bank.co.jp ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b77202d4-830d-4482-9c5b-87fecc4782bf","sortOrder":13},"sortOrder":13,"tags":null,"recentChangeFlags":null},{"id":"60c591ff-4e26-4b50-ad7d-bfe5f61744b7","uri":"https://*.rakutencheck.com","name":"*.rakutencheck.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d2cc20bb-9c2e-4542-8a7a-357aa5fe5b24","sortOrder":14},"sortOrder":14,"tags":null,"recentChangeFlags":null},{"id":"4157eb63-6d71-46d8-bd77-7e47da3bab96","uri":"https://*.smapo.jp","name":"*.smapo.jp","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4c4e1239-83b6-4624-b546-143853a2f1a0","sortOrder":15},"sortOrder":15,"tags":null,"recentChangeFlags":null},{"id":"57b51161-d5a0-4e9d-ba3f-07fcbb024fa3","uri":"https://*.rakutentrade.my","name":"*.rakutentrade.my","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e31b68ca-dce7-4a83-9493-932ef4e35eb2","sortOrder":16},"sortOrder":16,"tags":null,"recentChangeFlags":null},{"id":"c597bdcc-dd42-4d7c-9c76-a0f6362ca648","uri":null,"name":"*.rakuten-sonpo.co.jp ","category":"website","ipAddress":"https://*.rakuten-sonpo.co.jp ","description":null,"engagementBriefTargetGroupTarget":{"id":"16288114-fb63-4349-bd9a-543b59b786dc","sortOrder":17},"sortOrder":17,"tags":null,"recentChangeFlags":null},{"id":"d8e4991e-214f-4773-b65c-8ff79e16d6f6","uri":"https://rakuten-edy.co.jp","name":"*.rakuten-edy.co.jp","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a6ee85d7-0ac1-4639-9e7e-465131cb6018","sortOrder":18},"sortOrder":18,"tags":null,"recentChangeFlags":["entirely_new"]},{"id":"bdd29141-24b6-4cb3-af15-adf2053fc6d5","uri":"https://edy.jp","name":"*.edy.jp","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4db0c8c3-e53c-4fe7-b0e6-66fca2bcd495","sortOrder":19},"sortOrder":19,"tags":null,"recentChangeFlags":["entirely_new"]},{"id":"56390114-388a-42eb-9008-cf4aa8bd37d7","uri":"https://bitwallet.co.jp","name":" *.bitwallet.co.jp","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"af10a5b8-aaa2-4e1f-99b1-7500935008e2","sortOrder":20},"sortOrder":20,"tags":null,"recentChangeFlags":["entirely_new"]}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"c4276ea8-5fd1-4151-bf45-cc12d7d929ca","name":"Out of Scope Target","targets":[{"id":"dc1fc635-3639-4dc3-8814-a893b07482a0","uri":"","name":"STG/DEV subdomains in Rakuten Bank","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"efc86a0d-bc07-4e47-85cf-3fe3eeb23f82","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"3ec9f0cc-e1d0-44d3-8c6d-399eaa50e36d","uri":"","name":"STG/DEV subdomains in Rakuten Pay","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c8f2c027-a8b5-4a0d-99ab-9a66ccb890b0","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"1339994b-abf9-4f60-ab33-1f553031cb1f","uri":"","name":"STG/DEV subdomains in Rakuten Edy","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d89eca06-af4b-453d-825c-d08c41dcfb58","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eAll STG/DEV testing subdomain websites under Rakuten Pay, Rakuten Edy, and Rakuten Bank are out of scope.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"489ad4f5-e83e-4155-a17d-b628fff4d5c2","code":"rakuten-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"6497a43d-ee2a-4fb5-b37f-6f509f63f476","startsAt":"2024-08-20T12:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"eCommerce","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/6084/7ba3/60fa164f/959bac29ad310f1817cebc0f1f5b260f_rakuten.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-08-20T12:00:00.029Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/rakuten-vdp-pro","changelogs":"/engagements/rakuten-vdp-pro/changelog","submissions":null,"announcements":"/engagements/rakuten-vdp-pro/announcements","hallOfFame":"/engagements/rakuten-vdp-pro/hall_of_fames","crowdstream":"/engagements/rakuten-vdp-pro/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/rakuten-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=rakuten-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/rakuten-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/rakuten-vdp-pro/changelog","publishedAt":"2026-09-16T01:54:37.257Z","engagementChangelogUrl":"/engagements/rakuten-vdp-pro/changelog/74a53f5b-56a1-42b2-a54a-75d153060414","createUserFeedbacksUrl":"/engagements/rakuten-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/rakuten-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}