{"id":"3d443036-c530-47c2-8139-5649a834eb7b","engagementId":"ee7cd0b7-b76e-456e-9a03-9b85dca74992","data":{"brief":{"id":"7c0653fe-f004-42d3-b568-61ea5784f431","name":"SimpliSafe Managed Bug Bounty Engagement","tagline":"SimpliSafe designs award-winning smart home security systems that are wireless, affordable and user-friendly. Their seamless 24/7 professional monitoring protects 4 million people without the long-term contracts and sky-high prices of traditional alarm companies.","description":"\u003cp\u003eSimpliSafe's mission is to make every home secure. Delivering on that means putting our customers at the center of everything we do to improve their safety and comfort. Our home security solutions are designed with cutting-edge technology yet are affordable to purchase, easy to install and don’t require contracts. We protect more than four million people throughout the United States and the United Kingdom against everything from intruders to fires, water damage and more.\u003c/p\u003e\n\n\u003cp\u003eAs part of our commitment to our customers, we take data privacy and security issues very seriously. By engaging with talented security researchers across the globe through programs like Bugcrowd, SimpliSafe can more effectively identify and resolve suspected vulnerabilities. \u003c/p\u003e\n\n\u003cp\u003eThank you for participating in our program and helping protect SimpliSafe and its customers from potential threats.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eNow Public in September 2025!\u003c/h2\u003e\n\n\u003cp\u003eWe are excited to have this program open to the public. In these first weeks, we expect increased activity, so please keep these in mind while testing our targets:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eUse an account tied with your \u003ccode\u003e@bugcrowdninja.com\u003c/code\u003e email for all testing. We will block and restrict suspicious activity from other accounts. Submissions that involve other email addresses will be marked as Out of Scope.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eauth.simplisafe.com\u003c/code\u003e subdomain handles authentication and is owned by Auth0. Since SimpliSafe doesn’t own the system, it is Out of Scope for testing and suspicious activity will be blocked. Normal behavior with this system is expected as part of testing.\u003c/li\u003e\n\u003cli\u003eBe a good neighbor while testing our systems and refrain from activities that could affect system availability. We're co-workers now, so let's be kind to each other.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIf you have any questions about our systems or want to know more information to help test, feel free to reach out to support and they can pass the questions along.\u003c/p\u003e\n\n\u003cp\u003eThanks for joining us in our bug bounty program!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eGood luck, and happy hunting!\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of SimpliSafe not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to SimpliSafe, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eAccess:\u003c/h3\u003e\n\n\u003cp\u003eAll of the targets are accessible via the public internet and available. Simplisafe is designed for US and UK based customers. Access from other countries may inhibit testing.\u003c/p\u003e\n\n\u003cp\u003eOur systems help keep millions of our customers safe. Testing and research on a system can impact its ability to do so. Do not perform any testing on a system that you or others are actively using.\u003c/p\u003e\n\n\u003cp\u003eIf you encounter a \u003ccode\u003eWe are unable to create your account at this time\u003c/code\u003e error during account creation, reach out to Bugcrowd support or add a comment in a submission with your IP address and the email you used.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. With that email address, you can perform a Forgot Password reset to gain access to the account. You may register for accounts \u003ca href=\"https://webapp.simplisafe.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003ePLEASE NOTE: Submissions that are created \u003cem\u003e\u003cstrong\u003ewithout\u003c/strong\u003e\u003c/em\u003e using your @bugcrowdninja email will be marked as \u003cem\u003e\u003cstrong\u003eOut of Scope\u003c/strong\u003e\u003c/em\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExclusions:\u003c/h2\u003e\n\n\u003cp\u003eWe do not allow and will not review submissions based on:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ebrute force authentication requests\u003c/li\u003e\n\u003cli\u003edenial of service\u003c/li\u003e\n\u003cli\u003eweb crawling bots\u003c/li\u003e\n\u003cli\u003esocial engineering\u003c/li\u003e\n\u003cli\u003ephysical attacks\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eminor website misconfigurations such as 404 codes and others\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eExposed credentials found on a breach database or similar\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAny vulnerabilities found in our vendors’ products, e.g., third party software libraries, fall outside this policy’s scope and should be reported directly to the vendor according to their vulnerability disclosure policy.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eObviously, if we are using a vulnerable library or component and are affected by the vulnerability, that would be a finding we want to be submitted. But just utilizing a library that has a vulnerability shouldn't be a qualified finding.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eN-Day Policy:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eWhen N-Day bugs are released to the public, we will consider these as in scope \u003cem\u003eafter\u003c/em\u003e 14 days has gone by\n\n\u003cul\u003e\n\u003cli\u003ee.g: N-day released on 01/01/2023, we would consider it in-scope on 01/15/2023\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cp\u003eWebsites on subdomains linked to from simplisafe.com are out of scope. These include but are not limited to:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ecareers.simplisafe.com\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eclicks.simplisafe.com \u003c/li\u003e\n\u003cli\u003elibrary.simplisafe.com\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003elivechat.simplisafe.com\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003epress.simplisafe.com\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003esupport.simplisafe.com\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e for clarification before proceeding.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"6eb178ac-2208-4846-b3ef-1eb834311ba1","name":"SimpliSafe Home Security Platform - Backend","targets":[{"id":"abdccf28-65b0-43e6-b49d-3f3935da3d6c","uri":"https://bb1.simplisafe.com","name":"bb1.simplisafe.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3600ac5c-0216-4b5f-bc24-20291e8a04e7","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"abdccf28-65b0-43e6-b49d-3f3935da3d6c"},{"id":"86402f5d-20d0-4c88-92b9-0994786e4241","name":"C++","targetId":"abdccf28-65b0-43e6-b49d-3f3935da3d6c"}],"recentChangeFlags":null},{"id":"449e21bf-68ff-4553-b0e5-312a7dee9b58","uri":"https://bb2.simplisafe.com","name":"bb2.simplisafe.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1f4c5f12-10b3-4dea-accc-ab05c1611fcc","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"449e21bf-68ff-4553-b0e5-312a7dee9b58"},{"id":"86402f5d-20d0-4c88-92b9-0994786e4241","name":"C++","targetId":"449e21bf-68ff-4553-b0e5-312a7dee9b58"}],"recentChangeFlags":null},{"id":"d4885b85-bde3-4d6e-a116-eca0906c7ee3","uri":"https://cb.simplisafe.com","name":"cb.simplisafe.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"af8be9ca-e2c2-45b6-90b9-98d19be17217","sortOrder":2},"sortOrder":2,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d4885b85-bde3-4d6e-a116-eca0906c7ee3"},{"id":"86402f5d-20d0-4c88-92b9-0994786e4241","name":"C++","targetId":"d4885b85-bde3-4d6e-a116-eca0906c7ee3"}],"recentChangeFlags":null},{"id":"fcc63624-ed91-43da-bb79-9cd556ed26d1","uri":"","name":"api.simplisafe.com (HSP Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d0a4fc96-dffe-4872-84c0-826ed046cb27","sortOrder":3},"sortOrder":3,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"fcc63624-ed91-43da-bb79-9cd556ed26d1"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"fcc63624-ed91-43da-bb79-9cd556ed26d1"}],"recentChangeFlags":null},{"id":"26ff1433-3e56-403a-a703-2f9104c4c308","uri":"","name":"api.services.simplisafe.com (HSP Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f9dfdd58-d0ff-4340-93a0-158bb0590aec","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"26ff1433-3e56-403a-a703-2f9104c4c308"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"26ff1433-3e56-403a-a703-2f9104c4c308"}],"recentChangeFlags":null},{"id":"d6558681-2a23-49eb-952e-2e04616018c7","uri":"","name":"*.prd.cam.simplisafe.com (HSP Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"345d158e-b710-4e6a-bd77-69429d99f616","sortOrder":5},"sortOrder":5,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d6558681-2a23-49eb-952e-2e04616018c7"},{"id":"86402f5d-20d0-4c88-92b9-0994786e4241","name":"C++","targetId":"d6558681-2a23-49eb-952e-2e04616018c7"}],"recentChangeFlags":null},{"id":"fb1d383a-b4e2-49f1-8ee6-58c34bebaf0f","uri":"","name":"*.prd.platform.simplisafe.com (HSP Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6bdce51d-5a0b-40b5-9fdd-97b7bd7c853e","sortOrder":6},"sortOrder":6,"tags":[{"id":"1f10e73e-4eef-42c1-ba6b-6df69f8dc8fa","name":"Rust","targetId":"fb1d383a-b4e2-49f1-8ee6-58c34bebaf0f"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"fb1d383a-b4e2-49f1-8ee6-58c34bebaf0f"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"fb1d383a-b4e2-49f1-8ee6-58c34bebaf0f"}],"recentChangeFlags":null},{"id":"5afc55a4-8449-4961-89c6-6a75ea017691","uri":"","name":"*.prd.services.simplisafe.com (HSP Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e701f330-39f0-4e4c-a447-f6007005c9ef","sortOrder":7},"sortOrder":7,"tags":[{"id":"1f10e73e-4eef-42c1-ba6b-6df69f8dc8fa","name":"Rust","targetId":"5afc55a4-8449-4961-89c6-6a75ea017691"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"5afc55a4-8449-4961-89c6-6a75ea017691"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"5afc55a4-8449-4961-89c6-6a75ea017691"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"2485cdaa-534d-4389-9dec-76db378f5d7e","p1MaxCents":600000,"p1MinCents":400000,"p2MaxCents":300000,"p2MinCents":200000,"p3MaxCents":100000,"p3MinCents":60000,"p4MaxCents":50000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eSimpliSafe\u0026#39;s \u003cstrong\u003eHome Security Platform\u003c/strong\u003e comprises of the hardware devices and software services that our customers rely on to keep them safe. The below targets are the public backend software components that facilitate communication with our devices. We want to encourage researchers to use our hardware while testing and will award higher payouts when hardware was required.\u003c/p\u003e\n\n\u003cp\u003eBasestations establish connections and communicate with \u003ccode\u003ebb1.simplisafe.com\u003c/code\u003e and \u003ccode\u003ebb2.simplisafe.com\u003c/code\u003e\u003c/p\u003e\n\n\u003cp\u003eCameras establish connections and communicate with \u003ccode\u003ecb.simplisafe.com\u003c/code\u003e and \u003ccode\u003e*.prd.cam.simplisafe.com\u003c/code\u003e\u003c/p\u003e\n\n\u003cp\u003eThe Home Security Platform leverages APIs found at \u003ccode\u003eapi.simplisafe.com\u003c/code\u003e and \u003ccode\u003eapi.services.simplisafe.com\u003c/code\u003e, alongside communicating with services at \u003ccode\u003e*.prd.services.simplisafe.com\u003c/code\u003e\u003c/p\u003e","rewardRangeData":{"1":{"min":4000,"max":6000},"2":{"min":2000,"max":3000},"3":{"min":600,"max":1000},"4":{"min":250,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"511cefa6-69be-4482-a24a-fa738720aa51","name":"SimpliSafe Customer App","targets":[{"id":"57cdc654-362a-450b-b770-6b274cc9f034","uri":"https://webapp.simplisafe.com","name":"SimpliSafe Customer Webapp - US","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d0b509d1-1498-4396-9c12-4f21df50487f","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"57cdc654-362a-450b-b770-6b274cc9f034"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"57cdc654-362a-450b-b770-6b274cc9f034"}],"recentChangeFlags":null},{"id":"6b02d677-4d21-4766-accd-853c13946073","uri":"https://webapp.simplisafe.co.uk","name":"SimpliSafe Customer Webapp - UK","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fcc370a5-47dd-4bc6-be0f-42dbcc7526a1","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6b02d677-4d21-4766-accd-853c13946073"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"6b02d677-4d21-4766-accd-853c13946073"}],"recentChangeFlags":null},{"id":"bf512ebd-4842-4108-9a6c-76c10520b76c","uri":"https://apps.apple.com/us/app/simplisafe-home-security-app/id555798051","name":"SimpliSafe Customer iOS App","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f8582d3b-9eb2-4c84-b9a3-5cf2de356684","sortOrder":2},"sortOrder":2,"tags":[{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"bf512ebd-4842-4108-9a6c-76c10520b76c"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"bf512ebd-4842-4108-9a6c-76c10520b76c"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"bf512ebd-4842-4108-9a6c-76c10520b76c"}],"recentChangeFlags":null},{"id":"b6a81b1b-6b87-402b-bc81-c290348ce746","uri":"https://play.google.com/store/search?q=simplisafe\u0026c=apps","name":"SimpliSafe Customer Android App","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"293a27e9-6d40-469a-a4d0-70e9fb2f2569","sortOrder":3},"sortOrder":3,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"b6a81b1b-6b87-402b-bc81-c290348ce746"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"b6a81b1b-6b87-402b-bc81-c290348ce746"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"b6a81b1b-6b87-402b-bc81-c290348ce746"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"b6a81b1b-6b87-402b-bc81-c290348ce746"}],"recentChangeFlags":null},{"id":"2c17f5c0-5ce2-42b2-99bf-297a3bd12ca0","uri":"","name":"mfa.simplisafe.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4b2dcfca-7e32-4c0d-ba75-613544c29cd5","sortOrder":5},"sortOrder":5,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"2c17f5c0-5ce2-42b2-99bf-297a3bd12ca0"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"2c17f5c0-5ce2-42b2-99bf-297a3bd12ca0"},{"id":"59cdb1e5-8e65-4040-b1eb-c323dfee5a53","name":"Authentication Systems","targetId":"2c17f5c0-5ce2-42b2-99bf-297a3bd12ca0"}],"recentChangeFlags":null},{"id":"35d4daa0-6e7a-47d4-b9a3-b367afa1dc6d","uri":"","name":"*.prd.aser.simplisafe.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8966e6dd-ba01-413a-81f9-748c469ee3c8","sortOrder":6},"sortOrder":6,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"35d4daa0-6e7a-47d4-b9a3-b367afa1dc6d"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"35d4daa0-6e7a-47d4-b9a3-b367afa1dc6d"}],"recentChangeFlags":null},{"id":"f85c572e-e657-47c8-b08e-cfa517291584","uri":"","name":"*.prd.webapps.simplisafe.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f464bc3f-2ca0-462d-b4e1-5db5735fd19e","sortOrder":7},"sortOrder":7,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"f85c572e-e657-47c8-b08e-cfa517291584"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"f85c572e-e657-47c8-b08e-cfa517291584"}],"recentChangeFlags":null},{"id":"954fb0b8-c364-4893-ab77-dc8d7ccfec24","uri":"","name":"api.simplisafe.com (App Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6429e8a9-d52e-4b4e-aa20-3fb133d9a4cb","sortOrder":8},"sortOrder":8,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"954fb0b8-c364-4893-ab77-dc8d7ccfec24"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"954fb0b8-c364-4893-ab77-dc8d7ccfec24"}],"recentChangeFlags":null},{"id":"7d815c23-8010-455d-a8ac-43a7e1a30af5","uri":"","name":"api.services.simplisafe.com (App Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6f838fa0-bb8f-416e-9299-ff7b595998e4","sortOrder":9},"sortOrder":9,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"7d815c23-8010-455d-a8ac-43a7e1a30af5"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"7d815c23-8010-455d-a8ac-43a7e1a30af5"}],"recentChangeFlags":null},{"id":"4e8d7dac-2c53-4cb5-bec2-6225af9751ed","uri":"","name":"*.prd.services.simplisafe.com (App Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3193ce87-e074-4464-8c15-4f5e9ee30ce3","sortOrder":10},"sortOrder":10,"tags":[{"id":"1f10e73e-4eef-42c1-ba6b-6df69f8dc8fa","name":"Rust","targetId":"4e8d7dac-2c53-4cb5-bec2-6225af9751ed"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"4e8d7dac-2c53-4cb5-bec2-6225af9751ed"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"4e8d7dac-2c53-4cb5-bec2-6225af9751ed"}],"recentChangeFlags":null},{"id":"27312df4-7a2a-497d-be5c-7ebf18225bdb","uri":"","name":"*.prd.platform.simplisafe.com (App Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"53e7d3f9-8e96-4fe0-9b3d-84dbda8eaafa","sortOrder":11},"sortOrder":11,"tags":[{"id":"1f10e73e-4eef-42c1-ba6b-6df69f8dc8fa","name":"Rust","targetId":"27312df4-7a2a-497d-be5c-7ebf18225bdb"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"27312df4-7a2a-497d-be5c-7ebf18225bdb"}],"recentChangeFlags":null},{"id":"52ff5d29-a752-4f95-828a-658804cbbefe","uri":"","name":"media.simplisafe.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ff310165-3013-4fc6-ab79-4703e76d38d7","sortOrder":12},"sortOrder":12,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"52ff5d29-a752-4f95-828a-658804cbbefe"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"52ff5d29-a752-4f95-828a-658804cbbefe"}],"recentChangeFlags":null},{"id":"f304f020-6921-447d-8d9f-6c48a3132fc3","uri":"","name":"*.prd.cam.simplisafe.com (App Endpoints)","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"43e1548f-989c-4d1e-acdd-cc16245bc388","sortOrder":13},"sortOrder":13,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"f304f020-6921-447d-8d9f-6c48a3132fc3"},{"id":"86402f5d-20d0-4c88-92b9-0994786e4241","name":"C++","targetId":"f304f020-6921-447d-8d9f-6c48a3132fc3"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"187194bb-3922-4f72-aa79-f6b243d41c90","p1MaxCents":600000,"p1MinCents":350000,"p2MaxCents":300000,"p2MinCents":150000,"p3MaxCents":100000,"p3MinCents":50000,"p4MaxCents":50000,"p4MinCents":17500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eThe \u003cstrong\u003eSimpliSafe Customer App\u003c/strong\u003e is the primary way that our customers interact with their system through their smartphone or browser. We want to encourage researchers to use our hardware while testing and will award higher payouts when hardware was required for a submission.\u003c/p\u003e\n\n\u003cp\u003eFor the next few weeks, submissions opened against our recently announced \u003ca href=\"https://support.simplisafe.com/conversations/announcements/additional-user-access-now-available/67e310137ddfc6477b5b6214\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAdditional User Access\u003c/a\u003e feature are eligible for a 30% bonus on top of displayed rewards.\u003c/p\u003e\n\n\u003cp\u003eAuthentication is handled by \u003ccode\u003eauth.simplisafe.com\u003c/code\u003e which is owned by Auth0 and is subject to \u003ca href=\"https://bugcrowd.com/engagements/auth0-okta\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003etheir engagement terms\u003c/a\u003e. The subdomain is not in-scope of our engagement. MFA support comes from \u003ccode\u003emfa.simplisafe.com\u003c/code\u003e.\u003c/p\u003e\n\n\u003cp\u003eThe Customer App\u0026#39;s backend services are accessed through \u003ccode\u003e*.prd.aser.simplisafe.com\u003c/code\u003e and \u003ccode\u003e*.prd.webapps.simplisafe.com\u003c/code\u003e\u003c/p\u003e\n\n\u003cp\u003eThe Customer App leverages shared APIs found at \u003ccode\u003eapi.simplisafe.com\u003c/code\u003e and \u003ccode\u003eapi.services.simplisafe.com\u003c/code\u003e, alongside communicating with services at \u003ccode\u003e*.prd.services.simplisafe.com\u003c/code\u003e and \u003ccode\u003e*.prd.platform.simplisafe.com\u003c/code\u003e\u003c/p\u003e\n\n\u003cp\u003eVideo data is shared with the Customer App through \u003ccode\u003emedia.simplisafe.com\u003c/code\u003e and \u003ccode\u003e*.prd.cam.simplisafe.com\u003c/code\u003e\u003c/p\u003e","rewardRangeData":{"1":{"min":3500,"max":6000},"2":{"min":1500,"max":3000},"3":{"min":500,"max":1000},"4":{"min":175,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"dd7d99d7-7d46-451f-bcc0-1ab93727f9ee","name":"SimpliSafe Ecommerce Platform","targets":[{"id":"bec50629-2fc9-470d-9aea-c4c88bc74edc","uri":"https://simplisafe.com","name":"SimpliSafe Website - US","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6474cc9e-4c15-4ff2-9de4-65773820603c","sortOrder":0},"sortOrder":0,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"bec50629-2fc9-470d-9aea-c4c88bc74edc"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bec50629-2fc9-470d-9aea-c4c88bc74edc"}],"recentChangeFlags":null},{"id":"ab6eae09-a8b5-40a3-a8c8-77bf5183a163","uri":"https://simplisafe.co.uk","name":"SimpliSafe Website - UK","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c9e18837-9b69-4358-bee9-db53aaed95f9","sortOrder":1},"sortOrder":1,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"ab6eae09-a8b5-40a3-a8c8-77bf5183a163"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ab6eae09-a8b5-40a3-a8c8-77bf5183a163"}],"recentChangeFlags":null},{"id":"28315787-0790-4709-a9c5-754565cb212c","uri":"","name":"api.prd.commerce.simplisafe.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5c8ed354-a475-4da7-8984-83307ce54149","sortOrder":2},"sortOrder":2,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"28315787-0790-4709-a9c5-754565cb212c"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"28315787-0790-4709-a9c5-754565cb212c"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"48acfae9-ac88-4dac-8e90-f08b748e79f0","p1MaxCents":450000,"p1MinCents":350000,"p2MaxCents":250000,"p2MinCents":150000,"p3MaxCents":75000,"p3MinCents":50000,"p4MaxCents":22500,"p4MinCents":17500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003e\u003ccode\u003esimplisafe.com\u003c/code\u003e and \u003ccode\u003esimplisafe.co.uk\u003c/code\u003e are the front-end of \u003cstrong\u003eSimpliSafe\u0026#39;s Ecommerce Platform\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eAll calls to backend ecommerce services go through \u003ccode\u003eapi.prd.commerce.simplisafe.com\u003c/code\u003e\u003c/p\u003e\n\n\u003cp\u003eAll paths on the top-level domain are in scope. Webpages that are on a separate subdomain are out of scope.\u003c/p\u003e","rewardRangeData":{"1":{"min":3500,"max":4500},"2":{"min":1500,"max":2500},"3":{"min":500,"max":750},"4":{"min":175,"max":225},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"d5e84cc1-adca-443f-8a53-2bc561bf7e7c","name":"Out of Scope Targets","targets":[{"id":"fc3f638f-6c88-40c3-b61a-f25f112ea3ac","uri":"","name":"auth.simplisafe.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c04fc8b0-4f4f-4fce-969a-b77e9ff3ca17","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f10e73e-4eef-42c1-ba6b-6df69f8dc8fa","name":"Rust","targetId":"fc3f638f-6c88-40c3-b61a-f25f112ea3ac"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"fc3f638f-6c88-40c3-b61a-f25f112ea3ac"},{"id":"e18eb8da-333a-428b-aa65-4f9560491f2b","name":"Auth0","targetId":"fc3f638f-6c88-40c3-b61a-f25f112ea3ac"}],"recentChangeFlags":null},{"id":"2cb64286-87a5-4e79-8bad-3f34d4b90123","uri":"","name":"careers.simplisafe.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b5228200-48a3-4a30-95ff-8124050ca25e","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"99aa9521-2dc1-48da-acce-9e50e5a9059d","uri":"","name":"clicks.simplisafe.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c6413bfc-6773-45f9-9fed-4a68ed571ff4","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"f453cf08-088b-4d2f-b812-b411927be141","uri":"","name":"library.simplisafe.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e21eeca8-89e6-4c55-ab23-9282b71af7a2","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"bd885100-5d7f-48ae-bdbd-a47157489ad2","uri":"","name":"livechat.simplisafe.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b6816ba7-3b6e-496f-856d-be62fdbeae01","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"494737a6-3259-477d-9bf5-f58e19d72ba6","uri":"","name":"press.simplisafe.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f17d8677-fba6-4e72-a80b-35c2207edf32","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"5ef1db34-a6d1-4ab6-8564-8910d7bdca52","uri":"","name":"support.simplisafe.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0906bb5d-a83d-401c-a8fe-f12828594789","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":3,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eWhile our systems are generally resilient to a high number of requests, until further notice, rate limiting (or lack thereof) submissions are considered Out of Scope.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"ee7cd0b7-b76e-456e-9a03-9b85dca74992","code":"simplisafe","state":"in_progress","endsAt":null,"bountyId":"9b6eb60d-04dd-4b0f-8892-f0722a5d182b","startsAt":"2024-12-17T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/157e/50bd/b5a447d6/1a07685696e9b62d5c9083b993805278_simplisafe_logo.png","logoBackgroundColor":"#eaa339","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-12-17T18:00:00.701Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/simplisafe","changelogs":"/engagements/simplisafe/changelog","submissions":null,"announcements":"/engagements/simplisafe/announcements","hallOfFame":"/engagements/simplisafe/hall_of_fames","crowdstream":"/engagements/simplisafe/crowdstream"},"announcementsCount":4,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/simplisafe/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=simplisafe\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/simplisafe/engagement_subscribers","engagementChangelogsUrl":"/engagements/simplisafe/changelog","publishedAt":"2026-08-17T14:22:05.498Z","engagementChangelogUrl":"/engagements/simplisafe/changelog/3d443036-c530-47c2-8139-5649a834eb7b","createUserFeedbacksUrl":"/engagements/simplisafe/feedbacks","engagementCrowdstreamUrl":"/engagements/simplisafe/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}