{"id":"c6255a1b-4e66-4536-bb13-cc725c374079","engagementId":"be8de6cb-83ea-4edf-abb5-f6b652f1e821","data":{"brief":{"id":"54be6427-6a47-43e6-bd4b-2d3022503053","name":"SEEK ","tagline":"SEEK is a diverse group of companies that have a unified purpose to help people live more fulfilling and productive working lives and help organisations succeed.","description":"\u003cp\u003eSEEK is Australia's no. 1 jobs, employment, career and recruitment site. We invite the security researcher community to test SEEK's web applications and services. Thank you for participating!\u003c/p\u003e\n\n\u003ch2\u003eProgram Requirements\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDenial of Service, Rate Limiting, and other automated/volumetric attacks are not permitted. \u003cstrong\u003eDo NOT use automated tooling\u003c/strong\u003e against SEEK assets.\u003c/li\u003e\n\u003cli\u003eCustomer instances are not to be accessed in any way (no customer data is to be accessed, and customer credentials are not to be used or \"verified\").\u003c/li\u003e\n\u003cli\u003eAll testing must be conducted using your @bugcrowdninja.com email ID only. If you fail to use your @Bugcrowdninja.com email ID, you run the risk of getting blocked from accessing SEEK applications.\u003c/li\u003e\n\u003cli\u003eWe do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human input will be rejected.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRatings / Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor initial prioritisation, this program uses the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. Priority may be adjusted based on likelihood or impact. Where an issue is downgraded, a full explanation will be provided and the researcher may appeal.\u003c/p\u003e\n\n\u003cp\u003eTo maximise your reward and reduce payout time, please include:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eAttack scenario\u003c/strong\u003e: the most likely way an attacker could abuse this vulnerability.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eClear reproduction steps\u003c/strong\u003e: if we can't replicate the issue, we may not consider it serious.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecommended fix\u003c/strong\u003e: practical mitigation suggestions add value to the submission.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eTriage SLA\u003c/h3\u003e\n\n\u003cp\u003eP1/P2: triaged within one business week. P3/P4/P5: triaged within three business weeks.\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003eTesting is only authorised on assets listed as in scope. Any SEEK domain or property not listed is out of scope, including subdomains not explicitly covered by a wildcard. If you identify a vulnerability on a SEEK-owned asset that is not in scope, you may report it, but it may be ineligible for rewards.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eDo not submit contact forms, create support tickets, send emails, or otherwise generate work for staff outside the security team.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAccess to customer PII (jobseeker profiles and CVs).\u003c/li\u003e\n\u003cli\u003eSEEK corporate data.\u003c/li\u003e\n\u003cli\u003eAccess to SEEK's internal network.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eTarget Information\u003c/h2\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eTarget\u003c/th\u003e\n\u003cth\u003eInformation\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003e*.seek.com\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003eGives jobseekers a way to search and apply for jobs posted by advertisers (companies, recruiters, etc who post jobs). Jobseekers are able to upload a CV (resume), add profile information through the jobseeker website.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003e*.employer.seek.com\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003eDesigned for advertisers to post jobs onto \u003ccode\u003e*.seek.com\u003c/code\u003e and manage jobseekers who apply for the job.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003e*.seekpass.co\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003eFormerly Certsy, helps job seekers to verify their claimed credentials (e.g. right to work, valid driver's licence, etc) by providing evidence (eg passport, drivers licence, etc) that we can check with relevant authorities or other verification methods.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003e*.jobsdb.com\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003eSEEK's Asia jobseeker platform across Hong Kong and Thailand. Provides jobseekers a way to search and apply for jobs posted by advertisers, upload CVs, and manage profile information\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ccode\u003e*.jobstreet.com\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003eSEEK's Asia jobseeker platform across Indonesia, Malaysia, Philippines, and Singapore. Provides jobseekers a way to search and apply for jobs posted by advertisers, upload CVs, and manage profile information.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\n\u003ccode\u003e*.skinfra.xyz\u003c/code\u003e, \u003ccode\u003e*.myseek.xyz\u003c/code\u003e, \u003ccode\u003e*.outfra.xyz\u003c/code\u003e\n\u003c/td\u003e\n\u003ctd\u003eUsed to host SEEK's corporate services and API's that are not designed to be accessed or consumed directly by customers but instead by SEEK employees and services.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\n\u003ccode\u003e*.sol-data.com\u003c/code\u003e, \u003ccode\u003e*.jobapi.net\u003c/code\u003e \u003c/td\u003e\n\u003ctd\u003eUsed for capturing search metrics, search API's including jobs, locations, salaries, etc.\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eSome of these domains may not return any content by themselves, but are used within the context of typical application usage (e.g. authentication flows). Some host sites or APIs but most should be for SEEK employees only.\u003c/p\u003e\n\n\u003ch3\u003eCredentials\u003c/h3\u003e\n\n\u003cp\u003ePlease sign up for accounts using your \u003ccode\u003e@bugcrowdninja.com\u003c/code\u003e email address:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e*.seek.com\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e*.employer.seek.com\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eSEEK Pass (\u003ccode\u003ehttps://app.seekpass.co/sign-in\u003c/code\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e*.jobsdb.com\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e*.jobstreet.com\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eFor more info regarding \u003ccode\u003e@bugcrowdninja\u003c/code\u003e email addresses, see \u003ca href=\"https://researcherdocs.bugcrowd.com/v2.0/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Researcher Docs\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch2\u003eJob Posting Guidelines\u003c/h2\u003e\n\n\u003cp\u003eWhen posting jobs only post jobs using the following details:\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eJob title (must contain)\u003c/strong\u003e: \"Bugcrowd - Do Not Apply\"\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eJob location\u003c/strong\u003e: Iceland\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eJob ad classification\u003c/strong\u003e: Farming, Animals \u0026amp; Conservation → Farm Management\u003c/p\u003e\n\n\u003cp\u003eNew hirer accounts are now subject to an automated review process. As a result, your first test job ad may be rejected. If this happens, please submit a second test job ad, which can be approved where it meets the testing requirements above.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eDO NOT\u003c/strong\u003e post Premium Ads, upgrade to Premium Ads or apply for Guaranteed Hire.\u003c/p\u003e\n\n\u003ch3\u003eRules and Advice for SEEK Pass (formerly Certsy)\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eUse your @bugcrowdninja email address to set up a SEEK Pass account and a SEEK account, because you’ll need both accounts to test our sharing functionality.\u003c/li\u003e\n\u003cli\u003eIf you prefer, you can use fictional document information or images to test out the SEEK Pass verification flow. Our admin system should catch this and reject the check.\u003c/li\u003e\n\u003cli\u003eAfter submitting a verification request, you will be prompted to share the result with SEEK. This is an oAuth flow connecting your SEEK and SEEK Pass accounts for data sharing. You do not need to be successfully verified to do this step.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eFocus areas\u003c/h3\u003e\n\n\u003cp\u003eWe are most interested in critical vulnerabilities that allow access to customer PII data (user's profile's and CV's) or SEEK corporate data and access to SEEK's internal network.\u003c/p\u003e\n\n\u003cp\u003eFor SEEK Pass, we are most interested in critical vulnerabilities that allow access to customer PII and sensitive data (user profiles, CVs, identity documents, credential evidence, verified data, etc) or SEEK corporate data and access to SEEK’s internal network.\u003c/p\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAvailability/volumetric testing e.g.:\n\n\u003cul\u003e\n\u003cli\u003eDoS/DDoS/Network DoS\u003c/li\u003e\n\u003cli\u003eRate limiting bypass attempts\u003c/li\u003e\n\u003cli\u003eEmail bombing flooding\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eError pages ie. verbose error messages, stack traces, invalid status codes.\u003c/li\u003e\n\u003cli\u003eAdmin or maintenance pages ie. monitoring system login pages, pages with no sensitive information.\u003c/li\u003e\n\u003cli\u003eNon-sensitive exposed API keys ie. Google Maps, Raygun.\u003c/li\u003e\n\u003cli\u003eConfiguration that is not directly exploitable ie. cookie flags, weak security headers, email configuration, TLS configuration, password policy, session expiration, certificate pinning.\u003c/li\u003e\n\u003cli\u003ePre-authentication account takeover vulnerabilities.\u003c/li\u003e\n\u003cli\u003eVulnerabilities caused by unpatched or unsupported software, including: browsers, mobile applications, and mobile operating systems.\u003c/li\u003e\n\u003cli\u003eMobile issues that require root access ie. credentials in Android SharedPreferences.\u003c/li\u003e\n\u003cli\u003eMobile issues that rely on the abuse or misuse of Accessibility Services.\u003c/li\u003e\n\u003cli\u003eUnverified AI-generated reports (see Program Requirements).\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eUse of automated tooling\u003c/li\u003e\n\u003cli\u003eCustomer instances are not to be accessed in any way (i.e. no customer data is accessed, customer credentials are not to be used or \"verified\")\u003c/li\u003e\n\u003cli\u003eUse of non-bugcrowdninja email accounts\u003c/li\u003e\n\u003cli\u003eSocial engineering of any kind against SEEK employees or its users\u003c/li\u003e\n\u003cli\u003eThird party providers and services\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eLeaked Credentials\u003c/h2\u003e\n\n\u003cp\u003eSEEK welcomes submissions from researchers who have discovered exposed or breached credentials.\u003c/p\u003e\n\n\u003cp\u003eIf you believe you have found sensitive customer data (e.g., login credentials, API keys etc) or a way to access customer data (i.e. through a vulnerability) report it, but do not attempt to successfully validate if/that it works.\u003c/p\u003e\n\n\u003cp\u003eSEEK reserves the right to treat each submission and any option to reward on a case by case basis. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance.\u003c/p\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorised in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"5b1148a0-fa12-491a-9c7c-1393490aae97","name":"In Scope Targets","targets":[{"id":"442aee0f-ca2c-441c-9000-a24d1b41a7d4","uri":null,"name":"*.seek.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e7348a2b-aa73-4384-b065-567378cdf1d5","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"442aee0f-ca2c-441c-9000-a24d1b41a7d4"}],"recentChangeFlags":null},{"id":"d4241b31-8b5a-42ca-83ce-453feee405fc","uri":"https://*.employer.seek.com","name":"*.employer.seek.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"008ea01c-7a1f-4155-bfd9-1e9e23b8943e","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d4241b31-8b5a-42ca-83ce-453feee405fc"}],"recentChangeFlags":null},{"id":"799a2741-5649-4598-8f19-4b4bff46fb4a","uri":"","name":"*.seekpass.co","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d99ec84c-15e1-4573-a4b9-da82eaaaa5c3","sortOrder":2},"sortOrder":2,"tags":[{"id":"0ce93ddf-31a4-4663-b1ca-9a1ac7da35a3","name":"Stripe","targetId":"799a2741-5649-4598-8f19-4b4bff46fb4a"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"799a2741-5649-4598-8f19-4b4bff46fb4a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"799a2741-5649-4598-8f19-4b4bff46fb4a"}],"recentChangeFlags":null},{"id":"a0d06e16-5736-4cea-a583-0cbcd69a7b09","uri":"https://*.jobsdb.com","name":"*.jobsdb.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"43a28265-c268-42a1-a9d7-48fa51c300c0","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a0d06e16-5736-4cea-a583-0cbcd69a7b09"}],"recentChangeFlags":null},{"id":"f173a1aa-9332-45ff-bea4-987fc0d8fc13","uri":"https://*.jobstreet.com","name":"*.jobstreet.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"19410d21-28cb-485e-a871-f2736b34345b","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f173a1aa-9332-45ff-bea4-987fc0d8fc13"}],"recentChangeFlags":null},{"id":"d098853f-e7c3-4d29-88e7-efbeb66d3aaf","uri":"https://seekcdn.com","name":"https://seekcdn.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9a3642f4-5096-4501-9347-99a53b6f3931","sortOrder":5},"sortOrder":5,"tags":[{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"d098853f-e7c3-4d29-88e7-efbeb66d3aaf"}],"recentChangeFlags":null},{"id":"bf5c2f6b-03d4-47d7-88c5-d36c333aa236","uri":"https://*.myseek.xyz","name":"*.myseek.xyz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"12c4493a-df2a-4c88-aeb8-8f7be932a6ad","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bf5c2f6b-03d4-47d7-88c5-d36c333aa236"}],"recentChangeFlags":null},{"id":"c33db3ee-f63c-4eb1-a86a-bc0eb7f323ca","uri":null,"name":"*.outfra.xyz","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6e6a4aa9-5eb8-4431-922b-39a66135cc04","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c33db3ee-f63c-4eb1-a86a-bc0eb7f323ca"}],"recentChangeFlags":null},{"id":"8e82f0c6-d888-4af0-bcb7-d1fc8ddb8c7c","uri":null,"name":"*.skinfra.xyz","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c9fb0a86-aee4-467e-b92b-2bb513b037aa","sortOrder":8},"sortOrder":8,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8e82f0c6-d888-4af0-bcb7-d1fc8ddb8c7c"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"a2b4c40a-38d1-41eb-8dcf-ba28f7082ef1","p1MaxCents":1000000,"p1MinCents":500000,"p2MaxCents":500000,"p2MinCents":70000,"p3MaxCents":70000,"p3MinCents":20000,"p4MaxCents":20000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":5000,"max":10000},"2":{"min":700,"max":5000},"3":{"min":200,"max":700},"4":{"min":50,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"549c7297-2408-473b-8c9d-2b627d499eda","name":"API","targets":[{"id":"752dc3ed-94f9-4499-9cdb-549b5817c78c","uri":"https://graphql.seek.com","name":"graphql.seek.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6961546e-f222-4014-a6f9-db3693f314c1","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"752dc3ed-94f9-4499-9cdb-549b5817c78c"},{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"752dc3ed-94f9-4499-9cdb-549b5817c78c"}],"recentChangeFlags":null},{"id":"62b84c5e-34c4-4ed2-bdeb-f92c4d6d3d8a","uri":"https://auth.seek.com","name":"auth.seek.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d2cbf96c-6720-4678-8c6f-ba6614ee8a90","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"62b84c5e-34c4-4ed2-bdeb-f92c4d6d3d8a"}],"recentChangeFlags":null},{"id":"17b78703-c4af-4221-9e6d-b95e1081fce4","uri":null,"name":"*.jobapi.net","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ee10aefc-998a-4b75-a775-1a5ad80aee3a","sortOrder":2},"sortOrder":2,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"17b78703-c4af-4221-9e6d-b95e1081fce4"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"17b78703-c4af-4221-9e6d-b95e1081fce4"}],"recentChangeFlags":null},{"id":"290d1fad-e59d-4abc-a23c-85c583cb2c86","uri":null,"name":"*.sol-data.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fc358ccd-418e-4426-8962-aa974a4ddb59","sortOrder":3},"sortOrder":3,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"290d1fad-e59d-4abc-a23c-85c583cb2c86"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"290d1fad-e59d-4abc-a23c-85c583cb2c86"}],"recentChangeFlags":null},{"id":"67558da1-40a8-400d-8700-1676133f8e18","uri":null,"name":"*.aips-internal.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"06ea688c-e07f-41fc-a3d3-d335ade08a15","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"67558da1-40a8-400d-8700-1676133f8e18"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"67558da1-40a8-400d-8700-1676133f8e18"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"67558da1-40a8-400d-8700-1676133f8e18"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"a2b4c40a-38d1-41eb-8dcf-ba28f7082ef1","p1MaxCents":1000000,"p1MinCents":500000,"p2MaxCents":500000,"p2MinCents":70000,"p3MaxCents":70000,"p3MinCents":20000,"p4MaxCents":20000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eDeveloper documentation for SEEK APIs is available at \u003ca href=\"https://developer.seek.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developer.seek.com/\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003ePlease remember to follow the program rules when testing SEEK APIs. \u003c/p\u003e","rewardRangeData":{"1":{"min":5000,"max":10000},"2":{"min":700,"max":5000},"3":{"min":200,"max":700},"4":{"min":50,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"f361881e-d6ed-4d30-ab64-709e6191b7bd","name":"Mobile Targets","targets":[{"id":"3bfac361-8999-492a-af77-f45812c035c0","uri":"https://apps.apple.com/au/app/seek-jobs-job-search/id520400855","name":"SEEK mobile app for iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"17fe3f27-fe1b-486f-9826-1354269d71e0","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"3bfac361-8999-492a-af77-f45812c035c0"},{"id":"7cfc4b45-f690-4068-91cd-0a47a9d4eebf","name":"Cocoa","targetId":"3bfac361-8999-492a-af77-f45812c035c0"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"3bfac361-8999-492a-af77-f45812c035c0"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"3bfac361-8999-492a-af77-f45812c035c0"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"3bfac361-8999-492a-af77-f45812c035c0"}],"recentChangeFlags":null},{"id":"0ac0fbeb-86dd-4c08-b418-a0aad2733dde","uri":"https://play.google.com/store/apps/details?id=au.com.seek\u0026hl=en_AU\u0026gl=US","name":"SEEK mobile app for Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d32c1f74-582d-4d73-a7ee-31e7ba00f4db","sortOrder":1},"sortOrder":1,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"0ac0fbeb-86dd-4c08-b418-a0aad2733dde"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"0ac0fbeb-86dd-4c08-b418-a0aad2733dde"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"0ac0fbeb-86dd-4c08-b418-a0aad2733dde"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"0ac0fbeb-86dd-4c08-b418-a0aad2733dde"}],"recentChangeFlags":null},{"id":"e76bfeb9-a906-4ae6-b380-ba8eeb00b31d","uri":"https://apps.apple.com/au/app/certsy/id1617796159","name":"SEEK Pass Mobile App for iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"406288b9-eba8-4a7f-a594-cdcf4fa1f357","sortOrder":2},"sortOrder":2,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"e76bfeb9-a906-4ae6-b380-ba8eeb00b31d"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"e76bfeb9-a906-4ae6-b380-ba8eeb00b31d"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"e76bfeb9-a906-4ae6-b380-ba8eeb00b31d"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"e76bfeb9-a906-4ae6-b380-ba8eeb00b31d"}],"recentChangeFlags":null},{"id":"ee0fb48a-eda2-4bf5-bfdf-d20da6b0fa26","uri":"https://play.google.com/store/apps/details?id=com.certsy.app","name":"SEEK Pass Mobile App for Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e4976138-29fe-4196-be41-cabd0e433a2e","sortOrder":3},"sortOrder":3,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"ee0fb48a-eda2-4bf5-bfdf-d20da6b0fa26"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"ee0fb48a-eda2-4bf5-bfdf-d20da6b0fa26"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"ee0fb48a-eda2-4bf5-bfdf-d20da6b0fa26"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"a2b4c40a-38d1-41eb-8dcf-ba28f7082ef1","p1MaxCents":1000000,"p1MinCents":500000,"p2MaxCents":500000,"p2MinCents":70000,"p3MaxCents":70000,"p3MinCents":20000,"p4MaxCents":20000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":5000,"max":10000},"2":{"min":700,"max":5000},"3":{"min":200,"max":700},"4":{"min":50,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"be8de6cb-83ea-4edf-abb5-f6b652f1e821","code":"seek","state":"in_progress","endsAt":null,"bountyId":"9e54bdad-7bad-4d49-abe6-e75f0d0dba0d","startsAt":"2016-11-08T22:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/4a8f/3622/259cf49b/8fde5fec56f76f4641dfade8ca0ac21d_logo-seek-reverse.png","logoBackgroundColor":"#2a2d40","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2016-11-08T22:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/seek","changelogs":"/engagements/seek/changelog","submissions":null,"announcements":"/engagements/seek/announcements","hallOfFame":"/engagements/seek/hall_of_fames","crowdstream":"/engagements/seek/crowdstream"},"announcementsCount":19,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/seek/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=seek\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/seek/engagement_subscribers","engagementChangelogsUrl":"/engagements/seek/changelog","publishedAt":"2026-09-08T23:49:18.446Z","engagementChangelogUrl":"/engagements/seek/changelog/c6255a1b-4e66-4536-bb13-cc725c374079","createUserFeedbacksUrl":"/engagements/seek/feedbacks","engagementCrowdstreamUrl":"/engagements/seek/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}