{"id":"403c49b2-0f28-44d6-a1f8-8d70c45158b8","engagementId":"ba5e8d9d-f855-424a-8227-acf039797cb9","data":{"brief":{"id":"a813fd5a-0b61-4284-b6e1-c99d69385cfc","name":"Recorded Future Public Managed Bug Bounty Engagement","tagline":"Recorded Future empowers teams through custom threat reports, managed monitoring, workflow optimization, and global support to enhance security programs.","description":"\u003cp\u003eWelcome to the Recorded Future Bug Bounty program! No technology is perfect, and Recorded Future believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":null,"targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Recorded Future not listed in the targets section is out of scope. This includes any/all subdomains not listed above.  IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Recorded Future, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eCredentials:\u003c/h2\u003e\n\n\u003cp\u003eCredentials will not be provided for this engagement, however where accounts can be self-provisioned. When registering for an account, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e . \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cp\u003eWhen reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eClickjacking on pages with no sensitive actions\u003c/li\u003e\n\u003cli\u003eCross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\u003c/li\u003e\n\u003cli\u003eAttacks requiring MITM or physical access to a user's device.\u003c/li\u003e\n\u003cli\u003ePreviously known vulnerable libraries without a working Proof of Concept.\u003c/li\u003e\n\u003cli\u003eComma Separated Values (CSV) injection without demonstrating a vulnerability.\u003c/li\u003e\n\u003cli\u003eMissing best practices in SSL/TLS configuration.\u003c/li\u003e\n\u003cli\u003eAny activity that could lead to the disruption of our service (DoS).\u003c/li\u003e\n\u003cli\u003eContent spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\u003c/li\u003e\n\u003cli\u003eRate limiting or bruteforce issues on non-authentication endpoints\u003c/li\u003e\n\u003cli\u003eMissing best practices in Content Security Policy.\u003c/li\u003e\n\u003cli\u003eMissing HttpOnly or Secure flags on cookies\u003c/li\u003e\n\u003cli\u003eMissing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\u003c/li\u003e\n\u003cli\u003eVulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]\u003c/li\u003e\n\u003cli\u003eSoftware version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\u003c/li\u003e\n\u003cli\u003ePublic Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\u003c/li\u003e\n\u003cli\u003eTabnabbing\u003c/li\u003e\n\u003cli\u003eOpen redirect - unless an additional security impact can be demonstrated\u003c/li\u003e\n\u003cli\u003eIssues that require unlikely user interaction (e.g: \u003cem\u003eBroken link hijacking leading to external resources\u003c/em\u003e)\u003c/li\u003e\n\u003cli\u003eLists with leaked credentials\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eSpecific Out-of-scope for tria.ge\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eIDOR issues and similar regarding submitted samples and reports for the free tier.\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"7ba30a68-faaa-492e-be77-0c354afbcc5f","name":"In Scope Targets","targets":[{"id":"01d07838-f6c6-4e04-873c-a97ec632c07a","uri":"https://www.recordedfuture.com","name":"www.recordedfuture.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e5b80060-995d-4220-89e9-de105c76dfe8","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"01d07838-f6c6-4e04-873c-a97ec632c07a"}],"recentChangeFlags":null},{"id":"9d5a3ed5-5457-475b-8ab2-7336b5792e17","uri":"https://tria.ge","name":"https://tria.ge","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"829ec7f8-4013-4d6c-a1f7-d7f5e3e3fd00","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9d5a3ed5-5457-475b-8ab2-7336b5792e17"}],"recentChangeFlags":null},{"id":"25c88cd4-0ccf-457c-9aa6-8e8a7cd07fa1","uri":"https://id.recordedfuture.com","name":"id.recordedfuture.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"405f1656-1613-4129-b252-13b7dff6cbd4","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"25c88cd4-0ccf-457c-9aa6-8e8a7cd07fa1"}],"recentChangeFlags":null},{"id":"8396ff8a-81bf-433e-9e01-3d0bbde2c2c2","uri":"https://hatching.io","name":"hatching.io","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ab7c36f7-6b10-4e6c-8a0f-22aa08bac18e","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8396ff8a-81bf-433e-9e01-3d0bbde2c2c2"}],"recentChangeFlags":null},{"id":"71dbdc81-9054-41dc-9341-f08871b68870","uri":"https://geminiadvisory.io","name":"geminiadvisory.io","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e8f25fd8-d2e0-428b-9902-4c73a502cfff","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"71dbdc81-9054-41dc-9341-f08871b68870"}],"recentChangeFlags":null},{"id":"16d79f6d-4559-441e-a765-6510d312b91d","uri":"https://app.recordedfuture.com","name":"app.recordedfuture.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7a80a762-0632-4083-8d9d-da9a0d12de22","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"16d79f6d-4559-441e-a765-6510d312b91d"}],"recentChangeFlags":null},{"id":"78943a69-02d9-4038-8069-a1289a8746b1","uri":"https://api.recordedfuture.com","name":"api.recordedfuture.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fdf49e4d-b489-4fa4-8ccc-48633072f3b4","sortOrder":7},"sortOrder":7,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"78943a69-02d9-4038-8069-a1289a8746b1"}],"recentChangeFlags":null},{"id":"a76f4985-56d6-4079-b5be-97f05b3c0434","uri":"https://apps.apple.com/us/app/recorded-future/id1435597894","name":"Recorded Future iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9ef54143-dfff-43a8-bc7d-c979776ec9f0","sortOrder":8},"sortOrder":8,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"a76f4985-56d6-4079-b5be-97f05b3c0434"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"a76f4985-56d6-4079-b5be-97f05b3c0434"}],"recentChangeFlags":null},{"id":"5283333a-1f06-464e-abb2-3496e977b1c2","uri":"https://play.google.com/store/apps/details?id=com.recordedfuture.mobile\u0026hl=en_US","name":"Recorded Future Android","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9b31c526-245a-49ab-8b08-8a9c6f66d803","sortOrder":9},"sortOrder":9,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"5283333a-1f06-464e-abb2-3496e977b1c2"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"5283333a-1f06-464e-abb2-3496e977b1c2"}],"recentChangeFlags":null},{"id":"0101f028-b49d-4edc-b5a2-6057f5707dd0","uri":"https://securitytrails.com","name":"securitytrails.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ab5c03f1-ab15-4a57-803d-fee36132fe66","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0101f028-b49d-4edc-b5a2-6057f5707dd0"}],"recentChangeFlags":null},{"id":"73e5b7ff-d922-445b-9c7b-d332c2ec6ffc","uri":"https://www.riskrecon.com","name":"Riskrecon","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ad1b0a8d-e3de-4607-a09e-9fad8ad23ce4","sortOrder":10},"sortOrder":10,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"73e5b7ff-d922-445b-9c7b-d332c2ec6ffc"}],"recentChangeFlags":null},{"id":"cdd51d75-490c-40fe-aa73-68ac2886b7a8","uri":"https://vendor.riskrecon.com","name":"Riskrecon Vendor portal US","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0aae8af2-8040-48e2-bb89-5888c8e4617c","sortOrder":11},"sortOrder":11,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cdd51d75-490c-40fe-aa73-68ac2886b7a8"}],"recentChangeFlags":null},{"id":"fbc6ebd4-7b86-4208-9e89-64e62966610e","uri":"https://vendor.riskrecon.eu","name":"Riskrecon Vendor portal EU","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"dbf8039c-e9f8-4c99-893b-3c8d67ad8ed8","sortOrder":12},"sortOrder":12,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fbc6ebd4-7b86-4208-9e89-64e62966610e"}],"recentChangeFlags":null},{"id":"8cc9f92a-56f5-4aa7-bb7a-ec30bca084e3","uri":"https://api.riskrecon.com","name":"Riskrecon API us","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"caee8e1c-0aa8-4d42-9c0a-c2dd41686d8d","sortOrder":13},"sortOrder":13,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"8cc9f92a-56f5-4aa7-bb7a-ec30bca084e3"}],"recentChangeFlags":null},{"id":"7fac930c-a829-42a5-8e79-0adce172c6b5","uri":"https://api.riskrecon.eu","name":"Riskrecon API EU","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f20ce471-da2c-4346-ab21-b9997c11fb2f","sortOrder":14},"sortOrder":14,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"7fac930c-a829-42a5-8e79-0adce172c6b5"}],"recentChangeFlags":null},{"id":"9bfb2c5f-71d7-4326-a6d5-5b618bf1f36e","uri":"https://auth.riskrecon.com","name":"Riskrecon IDP US","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0801e06d-90d5-4f69-b070-6472f327625e","sortOrder":15},"sortOrder":15,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"9bfb2c5f-71d7-4326-a6d5-5b618bf1f36e"}],"recentChangeFlags":null},{"id":"399c404c-f84e-45fd-bb7c-0f0a410f6ea7","uri":"https://auth.riskrecon.eu","name":"Riskrecon IDP EU","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"da931411-4da8-41a5-89e2-1f5445078a63","sortOrder":16},"sortOrder":16,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"399c404c-f84e-45fd-bb7c-0f0a410f6ea7"}],"recentChangeFlags":null},{"id":"fe561e11-f416-4b44-a034-12d6e647e178","uri":"https://portal.riskrecon.com","name":"Riskrecon Portal US","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ce4beaca-8ed6-47fd-8354-69619b22d33a","sortOrder":17},"sortOrder":17,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fe561e11-f416-4b44-a034-12d6e647e178"}],"recentChangeFlags":null},{"id":"80c2b6d2-441d-44d8-b971-cb0f8f6b908e","uri":"https://portal.riskrecon.eu","name":"Riskrecon Portal EU","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c14e7a06-d783-4033-87ed-633e4ea7875d","sortOrder":18},"sortOrder":18,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"80c2b6d2-441d-44d8-b971-cb0f8f6b908e"}],"recentChangeFlags":null},{"id":"090ec8b7-ed92-451b-9712-22e75bb5ce05","uri":"https://mcp.recordedfuture.com","name":"Recorded Future MCP","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"213d5159-d3c7-40ba-80e4-b996501bee0f","sortOrder":19},"sortOrder":19,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"090ec8b7-ed92-451b-9712-22e75bb5ce05"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"87d3165e-ebe1-4eaf-91ae-93dda972113d","p1MaxCents":500000,"p1MinCents":500000,"p2MaxCents":200000,"p2MinCents":200000,"p3MaxCents":75000,"p3MinCents":75000,"p4MaxCents":25000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":5000,"max":5000},"2":{"min":2000,"max":2000},"3":{"min":750,"max":750},"4":{"min":250,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"ba5e8d9d-f855-424a-8227-acf039797cb9","code":"recorded-future-mbb-og","state":"in_progress","endsAt":null,"bountyId":"cfc39d70-7b26-499d-807f-c90e85e59a43","startsAt":"2026-03-12T22:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":null,"methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/046b/37c0/252268d3/b9c99222399ec2fef93238831d07ab77_idZuMNG48D_1772108100714.jpeg","logoBackgroundColor":"#2673B3","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2026-03-12T22:00:00.418Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/recorded-future-mbb-og","changelogs":"/engagements/recorded-future-mbb-og/changelog","submissions":null,"announcements":"/engagements/recorded-future-mbb-og/announcements","hallOfFame":"/engagements/recorded-future-mbb-og/hall_of_fames","crowdstream":"/engagements/recorded-future-mbb-og/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/recorded-future-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=recorded-future-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/recorded-future-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/recorded-future-mbb-og/changelog","publishedAt":"2026-06-17T06:40:52.877Z","engagementChangelogUrl":"/engagements/recorded-future-mbb-og/changelog/403c49b2-0f28-44d6-a1f8-8d70c45158b8","createUserFeedbacksUrl":"/engagements/recorded-future-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/recorded-future-mbb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}