{"id":"1450ec8b-3581-4da6-9025-960d20d7b4c9","engagementId":"0e04e976-3606-411c-90f3-a84e150a2c2c","data":{"brief":{"id":"9274f8b2-9d76-4661-932b-077671ace135","name":"SoundCloud","tagline":"SoundCloud is the world’s largest open audio platform. With over 200 million tracks from 20 million creators heard in 190 countries, what’s next in music is first on SoundCloud.","description":"\u003cp\u003eAt SoundCloud, we take the safety of our users very seriously. If you believe you have discovered a possible security vulnerability on our app(s), API(s), platform, or in any other SoundCloud service, please help us to fix it as quickly as possible by submitting your findings in accordance with this policy.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, you have the opportunity to appeal, and make a case for a higher priority.\u003c/p\u003e\n\n\u003cp\u003ePlease ensure to kindly include a video recording with your submission, showing the steps taken to find the vulnerability.\u003c/p\u003e","industryTagId":"ef2b9ee7-7f73-4978-9530-ad18bbf3f902","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in-scope and that are not explicitly listed out-of-scope. Any domain/property of Soundcloud not listed in the targets section is out of scope. \u003cbr\u003e\nIf you believe you've identified a vulnerability on a system outside the scope, please reach out to support@bugcrowd.com before submitting.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget information\u003c/h2\u003e\n\n\u003ch3\u003esoundcloud.com\u003c/h3\u003e\n\n\u003cp\u003eMain website for SoundCloud users\u003c/p\u003e\n\n\u003ch3\u003eapi-*.soundcloud.com\u003c/h3\u003e\n\n\u003cp\u003eOur various APIs for soundcloud.com, our mobile applications, partners and others. See blow for an overview of different API endpoints. The public API (api.soundcloud.com) documentation is available here: \u003ca href=\"https://developers.soundcloud.com/docs/api/guide\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developers.soundcloud.com/docs/api/guide\u003c/a\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eapi.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-auth.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-curators.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-deck.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-fortune.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-mobile-creators.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-mobile.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-mobi.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-partners.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-pss.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-v2.soundcloud.com\u003c/li\u003e\n\u003cli\u003eapi-widget.soundcloud.com\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003em.soundcloud.com / mobi.soundcloud.com\u003c/h3\u003e\n\n\u003cp\u003eMobile-optimized version of soundcloud.com\u003c/p\u003e\n\n\u003ch3\u003echeckout.soundcloud.com\u003c/h3\u003e\n\n\u003cp\u003ePayment site for purchasing SoundCloud Go and frontend to third-party payment platform\u003c/p\u003e\n\n\u003ch3\u003esecure.soundcloud.com\u003c/h3\u003e\n\n\u003cp\u003eCross-device sign-ins (e.g. signing in from Xbox) and password reset flow\u003c/p\u003e\n\n\u003ch3\u003ew.soundcloud.com\u003c/h3\u003e\n\n\u003cp\u003eSoundCloud’s embeddable player widget\u003c/p\u003e\n\n\u003ch3\u003es-cloud.net\u003c/h3\u003e\n\n\u003cp\u003es-cloud.net is running a number of private services. All services under this domain should be behind authentication and use TLS (some self-signed). We welcome any submissions for this scope that demonstrate a security impact, such as authentication bypass or disclosure of private information.\u003c/p\u003e\n\n\u003ch3\u003estore.soundcloud.com\u003c/h3\u003e\n\n\u003cp\u003eShopify-hosted storefront for SoundCloud merchandise and other items. We welcome any submissions for this scope that demonstrate a security impact due to a configuration issue managed or created by SoundCloud. Shopify-specific issues will be marked out-of-scope and should be submitted to Shopify's bounty program.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRules of Engagement\u003c/h2\u003e\n\n\u003cp\u003eBefore submitting a report \u003cstrong\u003eplease run a DNS query\u003c/strong\u003e for your domain and check if the respective CNAME points to a service owned by SoundCloud. If not, this domain is \u003cstrong\u003eout-of-scope\u003c/strong\u003e as we can not guarantee safe harbor for other 3rd party services. SoundCloud domains pointing to AWS, GCP or the IP range 178.249.136.0/21 are always in-scope, if not clearly marked out-of-scope.\u003c/p\u003e\n\n\u003ch3\u003eUser Accounts \u0026amp; Access\u003c/h3\u003e\n\n\u003cp\u003eNo credentials will be provided for this program. Researchers are encouraged to self-signup for and test using various types of user accounts (user accounts, artist accounts, etc.). \u003cstrong\u003eDO NOT\u003c/strong\u003e perform testing against any account you do not expressly own. You're free to create multiple accounts, but again, do not test against anything you don't personally own.\u003c/p\u003e\n\n\u003cp\u003ePlease note that there is an authenticated partners portal, but account credentials will not be supplied for this program. Feel free to test the authentication functionality.\u003c/p\u003e\n\n\u003ch3\u003eTesting Artist Pages \u0026amp; Comments\u003c/h3\u003e\n\n\u003cp\u003eWe don't want to affect production users or create illegitimate traffic for SoundCloud end-users. Testing input parameters (comments, messaging, etc.) should \u003cstrong\u003eNOT\u003c/strong\u003e be performed on real artist or user pages. However, you're free to create your own accounts to test these areas, or use the following designated artist page to test input functionality for vulnerabilities: \u003ca href=\"https://soundcloud.com/hobnobclanandthereflux\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://soundcloud.com/hobnobclanandthereflux\u003c/a\u003e\u003c/p\u003e\n\n\u003ch3\u003eTesting Payment Processing\u003c/h3\u003e\n\n\u003cp\u003eThis program does not provide testing funds or reimbursements. However, if desired, researchers are welcome to use their own money to test paid SoundCloud features. \u003c/p\u003e\n\n\u003ch3\u003eFocus Areas\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eExecution of arbitrary server-side code or system commands (RCE)\u003c/li\u003e\n\u003cli\u003eXSS vectors with potential for fast automatic replication / “wormability”\u003c/li\u003e\n\u003cli\u003eAccount take-over\u003c/li\u003e\n\u003cli\u003eAccess to non-streaming optimized-audio assets\u003c/li\u003e\n\u003cli\u003eAccess to exclusive content without paying\u003c/li\u003e\n\u003cli\u003eManipulation of Related Tracks feature\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eOut-of-Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eNetwork-level Denial of Service attacks\u003c/li\u003e\n\u003cli\u003eRate limiting attacks\u003c/li\u003e\n\u003cli\u003e\n\u003cem\u003eAny\u003c/em\u003e situation that affects a user that is not expressly yours\u003c/li\u003e\n\u003cli\u003e\n\u003cem\u003eAny\u003c/em\u003e situation that affects the integrity of third-party production data\u003c/li\u003e\n\u003cli\u003eCopyright infringement report form (\u003ca href=\"https://soundcloud.com/pages/copyright/report/form\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://soundcloud.com/pages/copyright/report/form\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBest practice recommendation without a proof-of-concept\u003c/li\u003e\n\u003cli\u003eTarget domains that do no belong to SoundCloud—make sure to check that the target domain indeed belongs to Soundcloud (run \u003ccode\u003edig \u0026lt;domain\u0026gt;\u003c/code\u003e) if the domain has a \u003ccode\u003eCNAME\u003c/code\u003e entry pointing to another domain that is not mentioned in the target section, this domain will also be counted as out-of-scope\u003c/li\u003e\n\u003cli\u003eViolations of our referral program Terms of Service\u003c/li\u003e\n\u003cli\u003eAny vulnerability the demonstrated impact of which is limited to an account that you already have access to\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eOut-of-Scope Mobile\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAPI Token / OAuth secret recoverable in application binaries\u003c/li\u003e\n\u003cli\u003eShared links leaked through the system clipboard\u003c/li\u003e\n\u003cli\u003eExploits requiring a rooted or jailbroken device\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eTemporarily Out-of-Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eUnauthorized access to paid features via direct API access (e.g. Insights on artists.soundcloud.com)\u003c/li\u003e\n\u003cli\u003eContent injection vulnerabilities within the rendered body of emails sent from our platform (including, but not limited to, HTML Injection, Stored/Reflected XSS, and CSS Injection)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003ePermitted Research\u003c/h2\u003e\n\n\u003cp\u003eWhitehat security researchers are always welcome, and responsible research and disclosure is not a matter for our lawyers. However, we do not tolerate any of the following, which will always be reported to the relevant authorities:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eany attempt to modify or destroy data (exempt for data specifically created in one or more test accounts for the purpose of the security research)\u003c/li\u003e\n\u003cli\u003eany attempt to interrupt or degrade the services we offer to our users\u003c/li\u003e\n\u003cli\u003eany attempt to execute a Denial of Service attack\u003c/li\u003e\n\u003cli\u003eany attempt to access a user's account or data (exempt for data specifically created in one or more test accounts for the purpose of the security research)\u003c/li\u003e\n\u003cli\u003eany research that involves violation of any applicable law\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eSafe harbor for researchers\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state or national laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through this program, or inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"f4f3871b-a9f3-45ce-99a2-0a1204b9aafa","name":"In-scope targets","targets":[{"id":"53f7e3b6-8e13-4a0c-b5dd-0be5396089e5","uri":"https://play.google.com/store/apps/details?id=com.soundcloud.android\u0026hl=en\u0026gl=US","name":"SoundCloud Android app","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"35348bb5-c134-4b6c-ba43-8dcff7bfd1c6","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"53f7e3b6-8e13-4a0c-b5dd-0be5396089e5"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"53f7e3b6-8e13-4a0c-b5dd-0be5396089e5"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"53f7e3b6-8e13-4a0c-b5dd-0be5396089e5"}],"recentChangeFlags":null},{"id":"4a7e2328-06a5-499f-b1f5-d706219058f4","uri":"https://soundcloud.com","name":"soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5acedce3-6257-46ce-8e71-a277e22f6126","sortOrder":0},"sortOrder":0,"tags":[{"id":"5a702681-f59c-463c-b266-f9e22a1e1d8a","name":"Scala","targetId":"4a7e2328-06a5-499f-b1f5-d706219058f4"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"4a7e2328-06a5-499f-b1f5-d706219058f4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4a7e2328-06a5-499f-b1f5-d706219058f4"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"4a7e2328-06a5-499f-b1f5-d706219058f4"}],"recentChangeFlags":null},{"id":"9256e7f1-4922-41cd-8e26-2ad1994c82bc","uri":"","name":"*.soundcloud.org","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6e8de360-3ba2-49f6-8576-52c80edf7420","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9256e7f1-4922-41cd-8e26-2ad1994c82bc"}],"recentChangeFlags":null},{"id":"7dd98465-da30-4712-9596-079e31f82e7a","uri":"","name":"*.s-cloud.net","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"abeadc2f-c1dd-4560-8274-1b80e15b6926","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7dd98465-da30-4712-9596-079e31f82e7a"}],"recentChangeFlags":null},{"id":"5aa12417-02e8-4ad4-b369-5724738c68b4","uri":"https://apps.apple.com/us/app/soundcloud-music-audio/id336353151","name":"SoundCloud iOS app","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5f942798-6515-4cbc-8be3-d5f41a021f46","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"5aa12417-02e8-4ad4-b369-5724738c68b4"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"5aa12417-02e8-4ad4-b369-5724738c68b4"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"5aa12417-02e8-4ad4-b369-5724738c68b4"}],"recentChangeFlags":null},{"id":"9ea3dd82-318f-4805-96fc-ed6cb9105c93","uri":"https://connect.soundcloud.com","name":"*.soundcloud.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cfabb26e-bb7c-4a1c-bf8e-6e339e454439","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"9ea3dd82-318f-4805-96fc-ed6cb9105c93"},{"id":"5a702681-f59c-463c-b266-f9e22a1e1d8a","name":"Scala","targetId":"9ea3dd82-318f-4805-96fc-ed6cb9105c93"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"9ea3dd82-318f-4805-96fc-ed6cb9105c93"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9ea3dd82-318f-4805-96fc-ed6cb9105c93"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"9ea3dd82-318f-4805-96fc-ed6cb9105c93"}],"recentChangeFlags":null},{"id":"fe711328-6be7-4f1a-9dc0-3821b7064df3","uri":"","name":"*.services.repostnetwork.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"db66d1dc-5c60-4f31-902b-56b71643078d","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"fe711328-6be7-4f1a-9dc0-3821b7064df3"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"fe711328-6be7-4f1a-9dc0-3821b7064df3"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"fe711328-6be7-4f1a-9dc0-3821b7064df3"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fe711328-6be7-4f1a-9dc0-3821b7064df3"}],"recentChangeFlags":null},{"id":"b4e674c0-ed28-47a8-b576-e07d3964a5e6","uri":"","name":"api-*.soundcloud.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8625385a-2c2b-4da7-b7bb-1efa99abf9a6","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"b4e674c0-ed28-47a8-b576-e07d3964a5e6"}],"recentChangeFlags":null},{"id":"4326f76c-088f-44d6-a756-79331a99826a","uri":"http://artists.soundcloud.com/","name":"artists.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a7dbdf45-b5e8-457e-b6ff-0a7def1f7728","sortOrder":0},"sortOrder":0,"tags":[{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"4326f76c-088f-44d6-a756-79331a99826a"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"4326f76c-088f-44d6-a756-79331a99826a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4326f76c-088f-44d6-a756-79331a99826a"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"4326f76c-088f-44d6-a756-79331a99826a"}],"recentChangeFlags":null},{"id":"a14f3ce4-2b18-4dde-8451-03735114188f","uri":"https://soundcloud.org","name":"soundcloud.org","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a348b31c-220a-4ca5-9fbb-658535b7adff","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a14f3ce4-2b18-4dde-8451-03735114188f"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"86b07e5e-68fa-42c5-bf2f-aa329d138999","p1MaxCents":450000,"p1MinCents":410000,"p2MaxCents":175000,"p2MinCents":150000,"p3MaxCents":85000,"p3MinCents":60000,"p4MaxCents":25000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eThe below mentioned targets are in-scope. We serve different webpages and API endpoints (api-*.soundcloud.com) on our subdomains. All these sub-domains are in scope, if not explicitly listed in the out of scope section.\u003c/p\u003e","rewardRangeData":{"1":{"min":4100,"max":4500},"2":{"min":1500,"max":1750},"3":{"min":600,"max":850},"4":{"min":200,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"b35f4673-8f43-4559-9dd8-2799f317b391","name":"Out-Of-Scope","targets":[{"id":"3b1a0123-af53-496b-aa7d-52bc11cf322d","uri":null,"name":"blog.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"505f70a1-e7cf-48c1-b996-82df1c683a35","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3b1a0123-af53-496b-aa7d-52bc11cf322d"}],"recentChangeFlags":null},{"id":"5eb7069b-3561-45ee-8216-725b559a03e4","uri":null,"name":"status.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cb184edc-65c8-4b4e-9774-5182d62cf6c0","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5eb7069b-3561-45ee-8216-725b559a03e4"}],"recentChangeFlags":null},{"id":"5307966e-c93e-4d10-84d3-cb2fd87e9b06","uri":null,"name":"help.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e6b6a156-1397-4610-8ce7-464915a00585","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5307966e-c93e-4d10-84d3-cb2fd87e9b06"}],"recentChangeFlags":null},{"id":"430460bd-2475-4f62-a5a7-d255c0f5f8f3","uri":null,"name":" community.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8913adfa-48ab-4318-9bb0-118a3559400a","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"430460bd-2475-4f62-a5a7-d255c0f5f8f3"}],"recentChangeFlags":null},{"id":"66633173-7b86-4b26-84bc-95cf2dd7f688","uri":null,"name":"copyright.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"84bb0ca7-1eb8-45ec-a8da-ee494badc022","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"66633173-7b86-4b26-84bc-95cf2dd7f688"}],"recentChangeFlags":null},{"id":"09a614a2-e244-4c92-800b-794519282173","uri":null,"name":"advertising.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1acd52e6-ef6c-429f-bbbc-e85782c33be1","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"09a614a2-e244-4c92-800b-794519282173"}],"recentChangeFlags":null},{"id":"ab6c52bb-c1ec-4255-bff7-888dca2b39b3","uri":"https://soundcloudmail.com","name":"soundcloudmail.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2d3aaa5d-8f9b-4adc-90c9-6b7e049a6772","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ab6c52bb-c1ec-4255-bff7-888dca2b39b3"}],"recentChangeFlags":null},{"id":"5d6084dd-8c33-414c-ad26-8124a99ba5bc","uri":null,"name":"press.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"809a5af5-7b95-46aa-9000-dcfef7510e68","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5d6084dd-8c33-414c-ad26-8124a99ba5bc"}],"recentChangeFlags":null},{"id":"b151f820-5dbd-4634-969e-62b7be4ca6b1","uri":"https://scdrops.soundcloud.com","name":"scdrops.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"826706a9-ff5c-452a-85b5-28314bd6ddf3","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b151f820-5dbd-4634-969e-62b7be4ca6b1"}],"recentChangeFlags":null},{"id":"30b56fc0-da47-43c4-a332-77abcb1c5f4b","uri":"https://promote.soundcloud.com","name":"promote.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"58640eb1-03e0-4a2c-be6a-90f6bb3e83d5","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"30b56fc0-da47-43c4-a332-77abcb1c5f4b"}],"recentChangeFlags":null},{"id":"e9b8f931-6c7a-4ff9-b9a6-de992e401cf2","uri":"","name":"contest.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fd7549a3-895d-497e-8ba4-61d912fd3115","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e9b8f931-6c7a-4ff9-b9a6-de992e401cf2"}],"recentChangeFlags":null},{"id":"a4f20231-5745-4bec-aff6-532dfbe4aad0","uri":"","name":"playback.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0b6a3532-8769-472e-aede-736358c7918d","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a4f20231-5745-4bec-aff6-532dfbe4aad0"}],"recentChangeFlags":null},{"id":"aa19eb93-d42c-4468-93a0-7a4d476d80be","uri":"","name":"jobs.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f1af20ec-b402-4421-bbba-a733ea0fc9f1","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"aa19eb93-d42c-4468-93a0-7a4d476d80be"}],"recentChangeFlags":null},{"id":"ea4652ef-4612-417f-ba38-177757122a98","uri":"","name":"playerone.soundcloud.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a63c1720-f440-47bc-87b8-ce9c3f7dcb1b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ea4652ef-4612-417f-ba38-177757122a98"}],"recentChangeFlags":null},{"id":"cb523e43-62b5-40cf-a4d2-aa0293713f9b","uri":"","name":"support.soundcloud.org","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c2c703d5-6228-4b4b-a32c-6cb1d86076a3","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"dd1070a7-b986-4365-97eb-f3907e941af3","uri":"","name":"secdomaintest.soundcloud.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ab3c0d21-adcc-4520-8760-8e8dd2569669","sortOrder":15},"sortOrder":15,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"dd1070a7-b986-4365-97eb-f3907e941af3"}],"recentChangeFlags":null},{"id":"44651138-dff2-4d1f-abc3-a15a83e934fe","uri":"","name":"firston.soundcloud.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6bb36f07-630b-4516-b62c-078432669bc4","sortOrder":16},"sortOrder":16,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"44651138-dff2-4d1f-abc3-a15a83e934fe"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"0e04e976-3606-411c-90f3-a84e150a2c2c","code":"soundcloud","state":"in_progress","endsAt":null,"bountyId":"80ec03e8-09a9-43d1-be60-4b0c260580eb","startsAt":"2018-01-09T20:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Entertainment","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/4970/fb7c/f88af33f/5363a6d21cfd2ad01beef1bf1bc4a8af_Screen_Shot_2017-12-05_at_12.51.03_PM.png","logoBackgroundColor":"#ff5500","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2018-01-09T20:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/soundcloud","changelogs":"/engagements/soundcloud/changelog","submissions":null,"announcements":"/engagements/soundcloud/announcements","hallOfFame":"/engagements/soundcloud/hall_of_fames","crowdstream":"/engagements/soundcloud/crowdstream"},"announcementsCount":16,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/soundcloud/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=soundcloud\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/soundcloud/engagement_subscribers","engagementChangelogsUrl":"/engagements/soundcloud/changelog","publishedAt":"2026-01-29T14:30:30.666Z","engagementChangelogUrl":"/engagements/soundcloud/changelog/1450ec8b-3581-4da6-9025-960d20d7b4c9","createUserFeedbacksUrl":"/engagements/soundcloud/feedbacks","engagementCrowdstreamUrl":"/engagements/soundcloud/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}