{"id":"3eb8f079-e3df-4899-ad24-b0038ecb0993","engagementId":"d358ebd7-7028-44c7-9fc3-83f741dd7753","data":{"brief":{"id":"a22abb64-be11-4e69-90bc-a87d410e57ca","name":"ROKT Vulnerability Disclosure","tagline":"Rokt is a global leader in marketing technology, helping companies seize the full potential of every transaction moment. Please submit your findings to this Vulnerability Disclosure Program.","description":"\u003cp\u003eNo technology is perfect and Rokt believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web apps, mobile apps, and APIs.\u003c/p\u003e\n\n\u003cp\u003eRokt is a B2B two-sided marketplace, with Partners (e-commerce websites that host ad placements) and Advertisers (whose ads run on the Rokt network). Partners and Advertisers use Rokt’s One Platform to manage their campaigns, spending, and other features of their integrations.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003cp\u003eIf you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Rokt, you can report it to this program. These out-of-scope submissions will be evaluated on a case-by-case basis.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRules of Engagement\u003c/h2\u003e\n\n\u003cp\u003eWe invite you to submit reports of any security-related issue or vulnerability.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eResearchers must make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service\u003c/li\u003e\n\u003cli\u003eResearchers must not modify data that does not belong to you\u003c/li\u003e\n\u003cli\u003ePlease be reasonable in your use of automated tools as you will be testing production systems\u003c/li\u003e\n\u003cli\u003eTools that may result in denial of service are prohibited\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e Testing for lack of rate limiting on signups and password reset requests\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"6ed6a2c4-4284-482e-b86f-514679e16c1a","name":"In Scope - Rokt One Platform","targets":[{"id":"a30fbc96-c382-4f5f-b55e-8a15f167e6c5","uri":"","name":"Any asset that belongs to ROKT","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"097648e2-73f0-4725-8686-c7e1f2379056","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a30fbc96-c382-4f5f-b55e-8a15f167e6c5"}],"recentChangeFlags":null},{"id":"8c793394-07d0-48be-8f1f-35dc3e695a8f","uri":"https://my.rokt.com/","name":"my.rokt.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0c913d43-51ae-4605-9fda-13135ae367d2","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"8c793394-07d0-48be-8f1f-35dc3e695a8f"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"8c793394-07d0-48be-8f1f-35dc3e695a8f"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"8c793394-07d0-48be-8f1f-35dc3e695a8f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8c793394-07d0-48be-8f1f-35dc3e695a8f"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"8c793394-07d0-48be-8f1f-35dc3e695a8f"}],"recentChangeFlags":null},{"id":"c5dc58c5-0c54-4303-ae0a-1abf7a89f8d9","uri":"https://op2-bff.rokt.com/","name":"op2-bff.rokt.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"86da57a9-23f2-4b17-8e4a-c207b8242edb","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c5dc58c5-0c54-4303-ae0a-1abf7a89f8d9"},{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"c5dc58c5-0c54-4303-ae0a-1abf7a89f8d9"}],"recentChangeFlags":null},{"id":"6940779e-1cfa-40ec-b6f2-84fa2adc4101","uri":"https://platform.rokt.com","name":"platform.rokt.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"778a87a6-3c77-425f-ab4f-eec67031effe","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"6940779e-1cfa-40ec-b6f2-84fa2adc4101"},{"id":"6a9fe373-cb50-48a4-8f00-f390acde8447","name":"JSON","targetId":"6940779e-1cfa-40ec-b6f2-84fa2adc4101"}],"recentChangeFlags":null},{"id":"4d1ce271-5631-4ecb-9ed6-677cf2ea2218","uri":"https://transactions.rokt.com","name":"transactions.rokt.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"99cbc7fa-c668-4d7a-b9e0-36c596e22b48","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"4d1ce271-5631-4ecb-9ed6-677cf2ea2218"}],"recentChangeFlags":null},{"id":"2d4ccdbf-5154-4bac-b5c3-6544dc25cd5d","uri":"https://www.rokt.com/partners/","name":"partner.rokt.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"059f2c01-751c-498e-805b-0e5e5a0d113c","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2d4ccdbf-5154-4bac-b5c3-6544dc25cd5d"}],"recentChangeFlags":null},{"id":"a0b28f59-0d42-4b41-a92b-5802160288bf","uri":"https://data.rokt.com/","name":"data.rokt.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"078ab017-ddef-4a25-b8c1-aa7b8113c9a9","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"a0b28f59-0d42-4b41-a92b-5802160288bf"}],"recentChangeFlags":null},{"id":"d49c5b24-09a7-4655-89f3-dd3418dccacf","uri":"https://experiments.rokt.com","name":"experiments.rokt.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"73b7288d-7c78-4c9b-8939-58f039bdb807","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d49c5b24-09a7-4655-89f3-dd3418dccacf"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eOne Platform is Rokt’s B2B tool suite that enables Partners to manage the types of offers they permit on their e-commerce website while allowing Advertisers to manage the creatives, spending, and other aspects of their ad campaigns.\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eXSS (not self-XSS) to leak JWT tokens\u003c/li\u003e\n\u003cli\u003eData leaks, in particular, Consumer PII/PCI leaks\u003c/li\u003e\n\u003cli\u003eBypass of ad creatives approval process\u003c/li\u003e\n\u003cli\u003eInjection of a malicious script in ad creatives\n\u003cem\u003e(You can preview advertising creatives in the user interface under Campaigns \u0026gt; Overview \u0026gt; Creatives \u0026gt; View \u0026gt; Creative preview)\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eRCE in our AWS environment\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eBeware that some subdomains of rokt.com point to third parties, please validate that assets on a subdomain demonstrably belong to Rokt.\u003c/li\u003e\n\u003cli\u003eWe are aware that our “Flash Service” (which displays a brief message at the top of the page for certain operations) is vulnerable to HTML injection, and will address this in the Flash Service. HTML injection issues that only manifest in the flash service will be marked as duplicates.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"d65a6920-5c14-4d3d-bfa3-c2ae36c40672","name":"In Scope -  Rokt SDKs Frontends and real-time APIs","targets":[{"id":"aa3ebf29-102b-44cb-a762-826c0747d674","uri":"","name":"api.rokt.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"277f92d3-b11e-40ae-92c4-c420783f0ef8","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"aa3ebf29-102b-44cb-a762-826c0747d674"}],"recentChangeFlags":null},{"id":"8088e660-49a2-48fb-8fa9-27118de4b412","uri":"","name":"api.data.rokt.com (custom audience, nurture)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ce353389-93a8-46f9-96ac-a5344915d01c","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"8088e660-49a2-48fb-8fa9-27118de4b412"}],"recentChangeFlags":null},{"id":"9dabf7af-e541-4cda-a855-adfc3c981c29","uri":"","name":"catalogs.rokt.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"18dca4dc-8859-4eac-a259-4e512d784364","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"9dabf7af-e541-4cda-a855-adfc3c981c29"}],"recentChangeFlags":null},{"id":"707e8715-723a-4871-92bd-0654f51e030a","uri":"","name":"public-api.rokt.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"acf0ea17-1c66-4c4b-9bae-01614b92c2df","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"707e8715-723a-4871-92bd-0654f51e030a"}],"recentChangeFlags":null},{"id":"9963e084-c5da-4e03-aec8-df1b43a5046a","uri":"","name":"mobile-api.rokt.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3fd5f90d-0a7b-4621-8de4-deab704d497a","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"9963e084-c5da-4e03-aec8-df1b43a5046a"}],"recentChangeFlags":null},{"id":"99ade3d9-6494-48d7-8441-4ecb2e397275","uri":"","name":"apps.rokt.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e823b3dc-de50-46c6-aea6-1d05e6b9f3bb","sortOrder":0},"sortOrder":0,"tags":[{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"99ade3d9-6494-48d7-8441-4ecb2e397275"}],"recentChangeFlags":null},{"id":"4f284b32-d82d-4bc5-b0b2-ceec8be82c13","uri":"","name":"wsdk.rokt.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4a83ab8e-4785-4d0c-a142-64f754e4299c","sortOrder":0},"sortOrder":0,"tags":[{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"4f284b32-d82d-4bc5-b0b2-ceec8be82c13"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eWeb SDK\u003c/h2\u003e\n\n\u003cp\u003e\u003ca href=\"https://docs.rokt.com/developers/integration-guides/web/overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.rokt.com/developers/integration-guides/web/overview\u003c/a\u003e\u003cbr\u003e\nThe Rokt Web software development kit (SDK) facilitates communication between the frontend of partner websites and Rokt\u0026#39;s own systems. The Web SDK contains functionality for both Rokt Ecommerce and Rokt Ads clients. Rokt Ecommerce clients use the Web SDK to display Rokt placements on their website. Advertisers use the Web SDK to integrate conversion data with Rokt.\u003c/p\u003e\n\n\u003cp\u003eWeb SDK is backed by Web API (WAPI), which is in scope.\u003c/p\u003e\n\n\u003ch2\u003eMobile SDKs\u003c/h2\u003e\n\n\u003cp\u003e\u003ca href=\"https://docs.rokt.com/developers/integration-guides/overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.rokt.com/developers/integration-guides/overview\u003c/a\u003e\u003cbr\u003e\nThe Rokt mobile SDKs enable you to integrate Rokt into your native mobile apps to drive more value from-and for-your customers. The SDK is built to be lightweight, secure, and simple to integrate and maintain, resulting in minimal lift for your engineering team.\u003c/p\u003e\n\n\u003cp\u003eMobile SDKs are backed by Mobile API (MAPI), which is in scope.\u003c/p\u003e\n\n\u003ch2\u003eEvent API\u003c/h2\u003e\n\n\u003cp\u003e\u003ca href=\"https://docs.rokt.com/developers/api-reference/event-api\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.rokt.com/developers/api-reference/event-api\u003c/a\u003e\u003cbr\u003e\nRokt’s Event API is a flexible and robust interface that can support any type of client event along with any associated attributes. Rokt Ecommerce partners can use the Event API in conjunction with the Web SDK for anomaly detection, helping catch inconsistencies in placement behavior.  Rokt Ads clients can use the Event API to integrate conversion data with Rokt, improving campaign performance and optimization.\u003c/p\u003e\n\n\u003ch2\u003eCart API\u003c/h2\u003e\n\n\u003cp\u003e\u003ca href=\"https://docs.rokt.com/developers/api-reference/cart-api\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.rokt.com/developers/api-reference/cart-api\u003c/a\u003e\u003cbr\u003e\nWith the Cart API, Rokt partners can add additional products to a customer\u0026#39;s cart within a transaction. The Cart API works with the Web SDK to help render frontend placements and provide hooks to update a customer\u0026#39;s cart.\u003c/p\u003e\n\n\u003ch2\u003eReporting API\u003c/h2\u003e\n\n\u003cp\u003e\u003ca href=\"https://docs.rokt.com/developers/api-reference/reporting\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.rokt.com/developers/api-reference/reporting\u003c/a\u003e\u003cbr\u003e\nThe Rokt Reporting API enables advertisers and partners to retrieve their performance data from the Rokt platform to build their own reports and dashboards. It\u0026#39;s an HTTP-based API that can be used to programmatically query and integrate Rokt data into external business applications.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eSince you are testing live systems, please review the Rules of Engagement. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.\u003c/p\u003e\n\n\u003cp\u003eWhere possible, please add \u003ccode\u003eX-BugBounty:\u003c/code\u003e and \u003ccode\u003erokt-test-session: true\u003c/code\u003e headers to your HTTP requests so that your test traffic can be excluded from our performance metrics.\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eSecurity boundary bypasses \u003ca href=\"https://docs.rokt.com/developers/integration-guides/data-and-security/web-security/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://docs.rokt.com/developers/integration-guides/data-and-security/web-security/\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eData leaks, in particular, Consumer PII/PCI leaks\u003c/li\u003e\n\u003cli\u003eBypass of ad creatives approval process\u003c/li\u003e\n\u003cli\u003eInjection of a malicious script in ad creatives\n\u003cem\u003e(You can preview advertising creatives in the user interface under Campaigns \u0026gt; Overview \u0026gt; Creatives \u0026gt; View \u0026gt; Creative preview)\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eRCE in our AWS environment\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eBeware that some subdomains of rokt.com point to third parties, please validate that assets on a subdomain demonstrably belong to Rokt.\u003c/p\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eBeware that some subdomains of rokt.com point to third parties, please validate that assets on a subdomain demonstrably belong to Rokt.\u003c/li\u003e\n\u003cli\u003eapi.roktcalendar.com\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"d358ebd7-7028-44c7-9fc3-83f741dd7753","code":"rokt-pte-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"b8dfc67b-c59f-4b83-9a83-bb72e7f8ebd0","startsAt":"2022-12-13T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/93d5/e905/ef477158/e4c00d1a7e24f01225e52009d04ce78a_Rokt_Logo_Black.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2022-12-13T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/rokt-pte-vdp-pro","changelogs":"/engagements/rokt-pte-vdp-pro/changelog","submissions":null,"announcements":"/engagements/rokt-pte-vdp-pro/announcements","hallOfFame":"/engagements/rokt-pte-vdp-pro/hall_of_fames","crowdstream":"/engagements/rokt-pte-vdp-pro/crowdstream"},"announcementsCount":2,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Priority Triage","submitReportUrl":"/engagements/rokt-pte-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=rokt-pte-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/rokt-pte-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/rokt-pte-vdp-pro/changelog","publishedAt":"2023-08-17T04:11:46.522Z","engagementChangelogUrl":"/engagements/rokt-pte-vdp-pro/changelog/3eb8f079-e3df-4899-ad24-b0038ecb0993","createUserFeedbacksUrl":"/engagements/rokt-pte-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/rokt-pte-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}