{"id":"0ac488c0-d1d5-42c0-8983-62b0eedd33ca","engagementId":"61baaac4-dbff-4ac3-914c-77a76ee2e09d","data":{"brief":{"id":"7d9dacd7-3679-4958-b713-152a0b7b9873","name":"SAP Invitational Bug Bounty Program","tagline":"(SAP's Customers, Partners \u0026 Employees excluded)","description":"\u003ch2\u003ePlease read this first\u003c/h2\u003e\n\n\u003cp\u003e🔎 \u003cem\u003ePlease \u003cstrong\u003edo not\u003c/strong\u003e submit any reports to this Private Invitational Program (i.e. do not click Submit report button above). In order to submit reports to SAP program's please read the full instructions below.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eAll submissions reported to this page will be marked as Not Applicable\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eIf you are not eligible to participate but would nevertheless like to responsibly disclose a vulnerability, please submit \u003ca href=\"https://www.sap.com/about/trust-center/security/incident-management.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eWhat is this?\u003c/h2\u003e\n\n\u003cp\u003e🌟 This initiative aims to recruit new security researchers into SAP's private bug bounty engagements. We're excited for the possibility of you joining and testing our applications! Are you up to the task? 🌟\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eAt SAP, our purpose is to help the world run better and improve people’s lives. Our promise is to innovate to help our customers run at their best. SAP is committed to helping every customer become a best-run business.\u003cbr\u003e\nOur company recognizes the importance of security, privacy and community, and values the input of hackers acting in good-faith to help us maintain a high standard for our users. This includes encouraging responsible vulnerability research and the disclosure of security vulnerabilities.\u003c/p\u003e\n\n\u003ch2\u003eEligibility\u003c/h2\u003e\n\n\u003cp\u003eBefore we jump in, there are a few things we have to check. In order to be invited to SAP's bug bounty engagements, you have to meet the following criteria:\u003cbr\u003e\n🔏 SAP's Customers, Partners \u0026amp; employees excluded\u003cbr\u003e\n✅ You must have a background check completed through Bugcrowd, if you haven't already.\u003cbr\u003e\n🔏 You must sign an NDA between you and SAP.\u003cbr\u003e\n🎯 You must have an accuracy rating of at least 80% and a valid P3 or greater submission.\u003c/p\u003e\n\n\u003ch3\u003ePlease refrain from submitting an application if you don't meet the accuracy rating requirement.\u003c/h3\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRewards and incentives: what do I get out of it?\u003c/h2\u003e\n\n\u003cp\u003e🕵️ You will be invited to the bug bounty engagements listed below that include many of SAP's biggest applications, offering a wide selection of targets to choose from with \u003cstrong\u003eauthenticated access\u003c/strong\u003e. These applications are used by millions of users each day!\u003cbr\u003e\n💸 SAP is committed to respond to you on a timely manner, communicate regularly about the progress of your submissions, and reward you fairly for your work according to the current market.\u003c/p\u003e\n\n\u003ch2\u003eI'm sold, how do I apply?\u003c/h2\u003e\n\n\u003cp\u003e📝 Please create a support ticket \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e and select the Hacker Request Type \u003cstrong\u003eSpecial Engagement: SAP Hacker Application\u003c/strong\u003e, as shown in the screenshot below:\u003c/p\u003e\n\n\u003cp\u003e\u003cimg src=\"https://bugcrowd.com/engagements/sap-private-invite/attachments/bc4536fb-0c03-40fa-9b86-62095546ed22\" alt=\"ticket_request.png\"\u003e\u003c/p\u003e\n\n\u003cp\u003e➡️ The subject must be \u003cstrong\u003eSAP Hacker Application \u0026lt;Your_Username\u0026gt;\u003c/strong\u003e. Bugcrowd will verify that you meet the eligibility requirements and invite you to the relevant programs. \u003cstrong\u003eDue to the high volume of applications, applications may take up to 4 weeks for review and processing.\u003c/strong\u003e We highly appreciate your patience!\u003c/p\u003e\n\n\u003chr\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003cp\u003e\u003cstrong\u003eTesting is only authorized on the targets listed as in scope\u003c/strong\u003e. \u003cbr\u003e\n\u003cem\u003eAny domain/property of SAP not explicitly listed is out of scope. This includes any/all subdomains/sites not specifically mentioned.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eIf you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to SAP, you can report it \u003ca href=\"https://vulnerability-form.cfapps.eu12.hana.ondemand.com/#\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. However, be aware that it is not eligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003cp\u003eAll penetration testing and automated scanning activities must be conducted in a manner that does not impact the performance or availability of our systems. Destructive practices including Denial of Service (DoS) attacks, resource exhaustion, DNS poisoning, rootkit installation, and similar activities are strictly prohibited. Additionally, testers must refrain from using real Personally Identifiable Information (PII) during testing. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003eAll SAP programs are fully committed to providing safe harbor for good-faith security research.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eReminder\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eAll submissions reported to this page will be marked as Not Applicable\u003c/strong\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"fddfbfd8-3b4c-4496-b25e-0ba78fd8d36f","name":"Our products","targets":[{"id":"0a25efff-4dee-47b7-b8fb-78f8c510d551","uri":"","name":"SAP SuccessFactors Employee Central","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2e11a14a-d975-4596-94dd-387ba05fdb26","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"792caac9-95d0-4c72-97db-facd8732f527","uri":"","name":"SAP SuccessFactors Recruiting Marketing","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8bba4a60-63f6-440e-86b7-b188cd184c15","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"a515e586-1067-45e6-9f30-7d147b79d649","uri":"","name":"SAP S/4HANA Cloud Public Edition","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"31a2ff34-dfd2-4bd0-95b4-31f7206c8118","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"518eb27a-07a2-466f-ba33-611458e92405","uri":"","name":"SAP S/4HANA Cloud Private Edition","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"454c40a6-f722-4404-9402-abee6562f4bb","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"2afea9f1-5a97-4412-ba42-f0f05d012d48","uri":"","name":"SAP Integrated Business Planning for Supply Chain","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"02eac1ff-42f9-4058-862d-aa9f9cc881b3","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"2d2fa7fd-8285-4452-bc68-5b890e628038","uri":"","name":"SAP Cloud ALM","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f8a3b3ae-2a37-49cf-89c0-caed35b941f5","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"8ac0b0f1-e5c0-4c85-bcf7-0695d9e6a917","uri":"","name":"SAP Customer Data Cloud portfolio from Gigya","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3bcce4e5-b526-4bdf-9116-869d50e61675","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"7a87d3db-74ce-4360-bc5a-7550e52ad6d9","uri":"","name":"SAP Customer Data Platform","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9d8b4260-6bc0-452a-93c1-09e55ca975cf","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null},{"id":"952b5e48-6865-4cfd-b054-fe259248de7f","uri":"","name":"SAP S/4HANA migration cockpit","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4a477177-111a-4490-bc63-8467387e369c","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null},{"id":"cb6e4ed8-37c9-417b-9788-a272b481ae0f","uri":"","name":"SAP Risk and Assurance Management","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2197e833-70c9-4a55-8072-ddd57cb8dad2","sortOrder":9},"sortOrder":9,"tags":null,"recentChangeFlags":null},{"id":"5a0413fd-02d8-426a-8cda-43db58db29d2","uri":"","name":"SAP Continuous Integration and Delivery","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d14d8174-c5d4-45ea-92dd-a10d7a66753e","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null},{"id":"b70b3b3e-2f31-4fed-b83a-3d3cf6a1b21b","uri":"","name":"SAP Order Management foundation","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cc504e1c-e66e-475b-83af-4048b5760ab1","sortOrder":11},"sortOrder":11,"tags":null,"recentChangeFlags":null},{"id":"eb574beb-5e8c-4b5e-b991-75eec68ea664","uri":"","name":"SAP Business Network for Logistics\t","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6b89dc0e-9c15-449b-8ede-467ff958c791","sortOrder":12},"sortOrder":12,"tags":null,"recentChangeFlags":null},{"id":"a92757e9-6a08-40d9-9bed-e2bb59cd60c1","uri":"","name":"SAP Decentralized Identity Verification","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ac6841cf-c33f-43cc-b166-bb37ac0f21ae","sortOrder":13},"sortOrder":13,"tags":null,"recentChangeFlags":null},{"id":"58f34ec6-3985-4829-829b-5c1016805ca7","uri":"","name":"SAP Order and Delivery Scheduling","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d58c8d0c-6198-4072-8e9e-5058a8957fb7","sortOrder":14},"sortOrder":14,"tags":null,"recentChangeFlags":null},{"id":"ed45976f-fdbc-4062-b930-ba274612c92a","uri":"","name":"SAP Business Network for Asset Collaboration","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8a8563eb-cabe-4b95-b652-9237a61cf8c5","sortOrder":15},"sortOrder":15,"tags":null,"recentChangeFlags":null},{"id":"7a27b8a7-6d5a-4fea-926d-1f161d974d4a","uri":"","name":"SAP Watch List Screening","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a7a5b4c6-885e-48f3-9640-abf5b55e2e27","sortOrder":16},"sortOrder":16,"tags":null,"recentChangeFlags":null},{"id":"7191df05-852f-404b-937f-840099a8925e","uri":"","name":"SAP BusinessObjects Business Intelligence platform","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"505c4850-05b6-4428-b560-d1bc26c7d2ff","sortOrder":17},"sortOrder":17,"tags":null,"recentChangeFlags":null},{"id":"776bd7f2-1e94-44fc-8bb3-fea9aa1d8097","uri":"","name":"SAP WalkMe","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bb590f00-b629-4652-b12f-47f03b8ef2e9","sortOrder":18},"sortOrder":18,"tags":null,"recentChangeFlags":null},{"id":"c4aac2ad-e85b-4168-904d-80d4b83eb300","uri":"","name":"SAP Signavio Process Intelligence","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ec263d99-3cb9-46f0-b4aa-fc8efbe10923","sortOrder":19},"sortOrder":19,"tags":null,"recentChangeFlags":null},{"id":"624248e0-fb9a-4065-9c84-43a46ad5f732","uri":"","name":"SAP Signavio Process Management","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c1168bad-54a6-4a5e-9f68-904fa75f7cca","sortOrder":20},"sortOrder":20,"tags":null,"recentChangeFlags":null},{"id":"566194b2-d23f-47e9-a152-c3457e17feeb","uri":"","name":"SAP AI Core","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0ae5e66b-d947-4161-9369-66464fae825c","sortOrder":21},"sortOrder":21,"tags":[{"id":"e82bba17-848b-4f2b-a2a5-58d2a83530d4","name":"Kubernetes","targetId":"566194b2-d23f-47e9-a152-c3457e17feeb"}],"recentChangeFlags":null},{"id":"dd38b165-b0f0-4679-b264-86d7ad41c751","uri":"","name":"SAP BusinessOne","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cec58177-d4c9-4bcb-bc3f-c9791436c8a5","sortOrder":22},"sortOrder":22,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"dd38b165-b0f0-4679-b264-86d7ad41c751"}],"recentChangeFlags":null},{"id":"958515d4-1329-4381-b49f-ce142e00c15f","uri":"","name":"Gardener","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6b147a9b-c829-410a-a749-d549f9ea38b4","sortOrder":23},"sortOrder":23,"tags":[{"id":"e82bba17-848b-4f2b-a2a5-58d2a83530d4","name":"Kubernetes","targetId":"958515d4-1329-4381-b49f-ce142e00c15f"}],"recentChangeFlags":null},{"id":"3ff232e1-3702-457a-a154-8c216e985779","uri":"","name":"SAP Concur","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"23fc40dc-4e6a-4057-8c59-9d3bc3315624","sortOrder":24},"sortOrder":24,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"5d69ced4-99ef-4501-93e1-654bee00de19","p1MaxCents":2000000,"p1MinCents":400000,"p2MaxCents":750000,"p2MinCents":200000,"p3MaxCents":250000,"p3MinCents":70000,"p4MaxCents":60000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eDisclaimer\u003c/h2\u003e\n\n\u003cp\u003eEach SAP product is different and rewards may vary between engagements. We aim to offer competitive rewards and promotions on a regular basis. Our highest paying engagements offers up to \u003cstrong\u003e$20,000\u003c/strong\u003e for P1 findings!\u003c/p\u003e\n\n\u003chr\u003e","rewardRangeData":{"1":{"min":4000,"max":20000},"2":{"min":2000,"max":7500},"3":{"min":700,"max":2500},"4":{"min":250,"max":600},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[{"id":"84eb4f29-45e9-4c03-a9ec-22beb1911959","attachmentPath":"https://bugcrowd.com/engagements/sap-private-invite/attachments/84eb4f29-45e9-4c03-a9ec-22beb1911959","name":"image-2024-08-02T15_27_47.170Z.png","filename":"image-2024-08-02T15_27_47.170Z.png","description":null,"icon":"fileImage","size":144033,"sizeLabel":"141 KB","uploadedAt":"17 Sep 2024","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/sap-private-invite/attachments/84eb4f29-45e9-4c03-a9ec-22beb1911959"},{"id":"bc4536fb-0c03-40fa-9b86-62095546ed22","attachmentPath":"https://bugcrowd.com/engagements/sap-private-invite/attachments/bc4536fb-0c03-40fa-9b86-62095546ed22","name":"ticket_request.png","filename":"ticket_request.png","description":null,"icon":"fileImage","size":144033,"sizeLabel":"141 KB","uploadedAt":"4 Oct 2024","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/sap-private-invite/attachments/bc4536fb-0c03-40fa-9b86-62095546ed22"}],"engagement":{"id":"61baaac4-dbff-4ac3-914c-77a76ee2e09d","code":"sap-private-invite","state":"in_progress","endsAt":null,"bountyId":"fafdedc4-14a0-497d-844f-69c124b881e9","startsAt":"2024-10-02T13:32:53Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/93e4/e8e7/ba7cc596/9fa2d16625fa91f12e3b8be0a39ffe4e_sap_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-10-04T15:30:34.043Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/sap-private-invite","changelogs":"/engagements/sap-private-invite/changelog","submissions":null,"announcements":"/engagements/sap-private-invite/announcements","hallOfFame":"/engagements/sap-private-invite/hall_of_fames","crowdstream":null},"announcementsCount":0,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/sap-private-invite/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=sap-private-invite\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/sap-private-invite/engagement_subscribers","engagementChangelogsUrl":"/engagements/sap-private-invite/changelog","publishedAt":"2026-07-06T08:44:07.947Z","engagementChangelogUrl":"/engagements/sap-private-invite/changelog/0ac488c0-d1d5-42c0-8983-62b0eedd33ca","createUserFeedbacksUrl":"/engagements/sap-private-invite/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}