{"id":"e1ff045a-ef97-4c1d-8847-264067c4188b","engagementId":"b3091ebb-2c08-4a65-a9dc-f7dac52f3b39","data":{"brief":{"id":"2c0dac0d-11e6-43ba-b1d6-9aa4e2a88cf8","name":"Sprout Social","tagline":"A Management and Engagement Platform for Social Business","description":"\u003ch3\u003eWhy Sprout's Bug Bounty?\u003c/h3\u003e\n\n\u003cp\u003eSprout Social’s social media management platform will help you find, form and deepen real connections with the people who love your brand. We invite you to test and help secure our primary publicly facing assets. We appreciate your efforts in making SproutSocial more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003ch3\u003eOut of Scope\u003c/h3\u003e\n\n\u003cp\u003eDMARC and SPF records will be considered out of scope\u003c/p\u003e\n\n\u003cp\u003eTesting is only authorized on the targets listed as In-Scope. \u003cem\u003eAny domain/property of SproutSocial not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e If you believe you've identified a vulnerability on a system outside the scope, please reach out to support@bugcrowd.com before submitting. \u003c/p\u003e\n\n\u003ch3\u003eA note about the targets above\u003c/h3\u003e\n\n\u003cp\u003eWe generally appreciate any bug reports about systems that we use. However, we cannot authorize testing against third parties that we may contract with, and such testing may be in violation of their terms of service. In addition, for anything hosted on AWS, please avoid using network scanners, as this is prohibited by AWS unless you have prior permission (and even then is prohibited in many cases).\u003c/p\u003e\n\n\u003cp\u003eThere are a few specific exclusions above. Please ensure that you have read and fully understood the target listing above before testing anything.\u003c/p\u003e\n\n\u003cp\u003eFor new features to test, please see the following:\u003cbr\u003e\n\u003ca href=\"https://sproutsocial.com/insights/release/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://sproutsocial.com/insights/release/\u003c/a\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eSprout Social offers a free 30-day trial, so go ahead and make an account (no credit card needed to sign up). Use your @bugcrowdninja.com email addresses when signing up. You may attach your own profiles to those accounts (this may be useful to give yourself more experience with the various parts of the app), or you may attach fake profiles of your choosing. We do not provide test accounts for use.\u003c/p\u003e\n\n\u003cp\u003eResearchers testing the mobile applications should note that we do not presently allow new account signups from the mobile apps. New trial accounts may be created on the site from a mobile browser, and subsequently used in the mobile applications.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eSafe Harbor:\u003c/h3\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through this program, or inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":"\u003cp\u003eYou may only test against an account for which you are the account owner or an agent authorized by the account owner to conduct such testing.\u003c/p\u003e\n\n\u003cp\u003eSprout Social prohibits the following types of research:\u003cbr\u003e\n\u0026lt;ul\u0026gt;\u0026lt;li\u0026gt;Accessing, or attempting to access, data that does not belong to you\u0026lt;/li\u0026gt;\u0026lt;li\u0026gt;Executing, or attempting to execute, a denial of service attack\u0026lt;/li\u0026gt;\u0026lt;li\u0026gt;Sending, or attempting to send, unsolicited or unauthorized email, spam or other forms of unsolicited messages\u0026lt;/li\u0026gt;\u0026lt;li\u0026gt;Testing third party websites, applications or services that integrate with Sprout Social\u0026lt;/li\u0026gt;\u0026lt;li\u0026gt;Knowingly posting, transmitting, uploading, linking to, sending or storing any malware, viruses or similar harmful software\u0026lt;/li\u0026gt;\u0026lt;li\u0026gt;Research conducted by minors, individuals on sanctions lists or individuals in countries on sanctions lists\u0026lt;/li\u0026gt;\u0026lt;/ul\u0026gt;\u003c/p\u003e\n\n\u003cp\u003eTo all security researchers who follow this Responsible Disclosure Policy, Sprout Social promises to:\u003cbr\u003e\n\u0026lt;ul\u0026gt;\u0026lt;li\u0026gt;Acknowledge receipt of your report in a timely manner\u0026lt;/li\u0026gt;\u0026lt;li\u0026gt;Provide an estimated time frame for addressing the vulnerability\u0026lt;/li\u0026gt;\u0026lt;li\u0026gt;Notify you when the vulnerability is fixed\u0026lt;/li\u0026gt;\u0026lt;li\u0026gt;Publicly acknowledge your responsible disclosure, if you wish\u0026lt;/li\u0026gt;\u0026lt;/ul\u0026gt;\u003c/p\u003e\n\n\u003cp\u003e\u0026lt;b\u0026gt;Please do not publicly disclose vulnerability details without express written consent from Sprout Social.\u0026lt;/b\u0026gt;\u003c/p\u003e"},"scope":[{"id":"12c88a72-dee5-497a-92ad-b6ab21528ab7","name":"In scope targets","targets":[{"id":"a8128502-83ed-459f-9fe4-59db8c7f36de","uri":"https://apps.apple.com/us/app/sprout-social/id475307859","name":"Sprout Social for iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f73db616-b62a-4726-a9d8-2f60d6971bc7","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"a8128502-83ed-459f-9fe4-59db8c7f36de"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"a8128502-83ed-459f-9fe4-59db8c7f36de"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"a8128502-83ed-459f-9fe4-59db8c7f36de"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"a8128502-83ed-459f-9fe4-59db8c7f36de"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"a8128502-83ed-459f-9fe4-59db8c7f36de"}],"recentChangeFlags":null},{"id":"7052033d-feb9-4ec1-a08c-1f30d43850ac","uri":"https://sproutsocial.com/insights/sprout-social-android/","name":"Sprout Social for Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"529ebd81-b648-4bd9-9b5b-182faca239ad","sortOrder":1},"sortOrder":1,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"7052033d-feb9-4ec1-a08c-1f30d43850ac"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"7052033d-feb9-4ec1-a08c-1f30d43850ac"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"7052033d-feb9-4ec1-a08c-1f30d43850ac"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"7052033d-feb9-4ec1-a08c-1f30d43850ac"}],"recentChangeFlags":null},{"id":"a586c25b-6ce9-40eb-97b3-04f6e0b52fbb","uri":"https://sproutsocial.com/adapt/","name":"sproutsocial.com/adapt/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9905783d-72c2-4044-876f-e274b5cf7df6","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a586c25b-6ce9-40eb-97b3-04f6e0b52fbb"}],"recentChangeFlags":null},{"id":"0c6e9bc9-ffd3-4ffa-879d-b129a8025e93","uri":"https://sproutsocial.com/insights","name":"sproutsocial.com/insights","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7c31e40d-57d6-4eb8-ada4-c6b4e4596714","sortOrder":3},"sortOrder":3,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"0c6e9bc9-ffd3-4ffa-879d-b129a8025e93"},{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"0c6e9bc9-ffd3-4ffa-879d-b129a8025e93"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"0c6e9bc9-ffd3-4ffa-879d-b129a8025e93"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"0c6e9bc9-ffd3-4ffa-879d-b129a8025e93"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"0c6e9bc9-ffd3-4ffa-879d-b129a8025e93"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0c6e9bc9-ffd3-4ffa-879d-b129a8025e93"}],"recentChangeFlags":null},{"id":"8f808d1e-d3be-4782-b8ca-082491454ad7","uri":"https://sprout.link","name":"sprout.link","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cf2e14c8-88e3-49fb-a56d-6c7a0c47db4f","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8f808d1e-d3be-4782-b8ca-082491454ad7"}],"recentChangeFlags":null},{"id":"8e6f85c4-7815-41b2-90a8-159c882fbb56","uri":"https://media.sproutsocial.com","name":"media.sproutsocial.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8614b48f-7a18-461a-9561-84b594239047","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8e6f85c4-7815-41b2-90a8-159c882fbb56"}],"recentChangeFlags":null},{"id":"3084601d-8df7-41cc-a63a-3547b2964a7b","uri":"https://sproutsocial.com","name":"sproutsocial.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"da97f0e5-40be-408f-a669-d24e87f0accd","sortOrder":6},"sortOrder":6,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"3084601d-8df7-41cc-a63a-3547b2964a7b"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"3084601d-8df7-41cc-a63a-3547b2964a7b"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"3084601d-8df7-41cc-a63a-3547b2964a7b"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"3084601d-8df7-41cc-a63a-3547b2964a7b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3084601d-8df7-41cc-a63a-3547b2964a7b"}],"recentChangeFlags":null},{"id":"d53d3ebd-368a-47af-a554-aecfaefff207","uri":"https://advocacy.sproutsocial.com","name":"advocacy.sproutsocial.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"53c7ea37-6c8e-44a0-9ab9-79258017255e","sortOrder":7},"sortOrder":7,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"d53d3ebd-368a-47af-a554-aecfaefff207"},{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"d53d3ebd-368a-47af-a554-aecfaefff207"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d53d3ebd-368a-47af-a554-aecfaefff207"}],"recentChangeFlags":null},{"id":"655d2154-0d3a-4b9f-8a26-d4d3f48fdc47","uri":"https://api.advocacy.sproutsocial.com","name":"api.advocacy.sproutsocial.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"477e714c-f56f-4266-ade8-09029022b4dc","sortOrder":8},"sortOrder":8,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"655d2154-0d3a-4b9f-8a26-d4d3f48fdc47"}],"recentChangeFlags":null},{"id":"325c9237-5eec-462d-9922-3aaae4e43286","uri":"https://taggermedia.com","name":"*.taggermedia.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c0f2e004-8e26-4286-9f41-f2823ddbc3bc","sortOrder":9},"sortOrder":9,"tags":[{"id":"5a702681-f59c-463c-b266-f9e22a1e1d8a","name":"Scala","targetId":"325c9237-5eec-462d-9922-3aaae4e43286"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"325c9237-5eec-462d-9922-3aaae4e43286"}],"recentChangeFlags":null},{"id":"453ea98d-ef46-4577-a5b3-5810b5012fe2","uri":"https://influencer.sproutsocial.com","name":"influencer.sproutsocial.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d3074e97-29f3-4e1a-8e9d-52a43351e020","sortOrder":10},"sortOrder":10,"tags":[{"id":"5a702681-f59c-463c-b266-f9e22a1e1d8a","name":"Scala","targetId":"453ea98d-ef46-4577-a5b3-5810b5012fe2"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"453ea98d-ef46-4577-a5b3-5810b5012fe2"}],"recentChangeFlags":null},{"id":"ac6b07a4-7630-42bf-97a3-034e6316a23f","uri":"https://creatorhub.sproutsocial.com","name":"creatorhub.sproutsocial.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"167825fa-694e-4854-929d-9e6b87c24ca1","sortOrder":11},"sortOrder":11,"tags":[{"id":"5a702681-f59c-463c-b266-f9e22a1e1d8a","name":"Scala","targetId":"ac6b07a4-7630-42bf-97a3-034e6316a23f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ac6b07a4-7630-42bf-97a3-034e6316a23f"}],"recentChangeFlags":null},{"id":"da587660-a6c1-4bc8-8d6f-551221d76079","uri":"https://api.influencer.sproutsocial.com","name":"api.influencer.sproutsocial.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"508c5d88-42dc-4884-b984-217ff5473a29","sortOrder":12},"sortOrder":12,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"da587660-a6c1-4bc8-8d6f-551221d76079"}],"recentChangeFlags":null},{"id":"4c3d95ff-0e27-43ca-8a20-c235be5893c6","uri":"https://app.sproutsocial.com","name":"app.sproutsocial.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6adaf2d6-dd7d-4fde-bee5-1cedc5d6a89d","sortOrder":13},"sortOrder":13,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"4c3d95ff-0e27-43ca-8a20-c235be5893c6"},{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"4c3d95ff-0e27-43ca-8a20-c235be5893c6"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"4c3d95ff-0e27-43ca-8a20-c235be5893c6"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"4c3d95ff-0e27-43ca-8a20-c235be5893c6"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"4c3d95ff-0e27-43ca-8a20-c235be5893c6"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4c3d95ff-0e27-43ca-8a20-c235be5893c6"}],"recentChangeFlags":null},{"id":"aaa01287-fece-4afa-808b-b07fc6b83688","uri":"https://app.sproutsocial.eu","name":"app.sproutsocial.eu","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e5c5a7c4-4928-4796-b68a-42a2b8cda0a8","sortOrder":14},"sortOrder":14,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"aaa01287-fece-4afa-808b-b07fc6b83688"}],"recentChangeFlags":null},{"id":"fcad27e6-ffa7-4141-b983-fe7f7335a37f","uri":"https://identity.sproutsocial.com","name":"identity.sproutsocial.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"76410b67-51f1-44c0-b0e0-530304155638","sortOrder":15},"sortOrder":15,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fcad27e6-ffa7-4141-b983-fe7f7335a37f"}],"recentChangeFlags":null},{"id":"28a4285a-54d0-486f-8bbf-3f526ede1b3e","uri":"https://identity.sproutsocial.eu","name":"identity.sproutsocial.eu","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6c8d0955-a78f-49f5-87d4-0e7c4f7c9544","sortOrder":16},"sortOrder":16,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"28a4285a-54d0-486f-8bbf-3f526ede1b3e"}],"recentChangeFlags":null},{"id":"4e698d22-0cf5-444d-8d0b-fd850ba04e28","uri":"https://revenue.sproutsocial.com","name":"revenue.sproutsocial.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c8c6d6f1-4d05-4ccc-b61d-cb55bcdfb0ad","sortOrder":17},"sortOrder":17,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4e698d22-0cf5-444d-8d0b-fd850ba04e28"}],"recentChangeFlags":null},{"id":"d9cf7ced-00ca-4b97-84e1-3288cf70a30c","uri":"https://revenue.sproutsocial.eu","name":"revenue.sproutsocial.eu","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1d24b25e-d7bd-419a-ab8e-da4f94b0e2f3","sortOrder":18},"sortOrder":18,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d9cf7ced-00ca-4b97-84e1-3288cf70a30c"}],"recentChangeFlags":null},{"id":"67105e1d-d6d4-4b08-ab30-f7bb782c649a","uri":"https://sockets.sproutsocial.com","name":"sockets.sproutsocial.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3837869c-d9d1-455c-967c-1844be9f5a46","sortOrder":19},"sortOrder":19,"tags":[{"id":"537a37bb-0fd5-4cb3-88b3-d08fac588565","name":"Websockets","targetId":"67105e1d-d6d4-4b08-ab30-f7bb782c649a"}],"recentChangeFlags":null},{"id":"bca90188-d7aa-40d2-b31e-59fba14c8652","uri":"https://sockets.sproutsocial.eu","name":"sockets.sproutsocial.eu","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"157ccc89-a50d-4cfa-b474-5da70631c45e","sortOrder":20},"sortOrder":20,"tags":[{"id":"537a37bb-0fd5-4cb3-88b3-d08fac588565","name":"Websockets","targetId":"bca90188-d7aa-40d2-b31e-59fba14c8652"}],"recentChangeFlags":null},{"id":"932d6e3b-ae84-4cb1-ade7-3cab789f56d2","uri":"https://secure-form.sproutsocial.com","name":"secure-form.sproutsocial.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"89a67a14-f82f-45bb-8166-32e0f720b803","sortOrder":21},"sortOrder":21,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"932d6e3b-ae84-4cb1-ade7-3cab789f56d2"}],"recentChangeFlags":null},{"id":"2daaa91e-8b87-4139-aea4-490735d88362","uri":"https://secure-form.sproutsocial.eu","name":"secure-form.sproutsocial.eu","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"47a14d20-9d52-4232-a246-d8c03d9c51a4","sortOrder":22},"sortOrder":22,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2daaa91e-8b87-4139-aea4-490735d88362"}],"recentChangeFlags":null},{"id":"f05b6834-9263-45b4-a378-cbb9bc940284","uri":"https://share.sproutsocial.com","name":"share.sproutsocial.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"44bc0780-278e-486b-8c20-13fb2901dd21","sortOrder":23},"sortOrder":23,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f05b6834-9263-45b4-a378-cbb9bc940284"}],"recentChangeFlags":null},{"id":"105131f4-3ef0-4601-821e-fe2b73cde5f0","uri":"https://app.sproutsocial.com/api","name":"app.sproutsocial.com/api","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e411b233-b7fe-442f-a5a2-a3adec11445b","sortOrder":24},"sortOrder":24,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"105131f4-3ef0-4601-821e-fe2b73cde5f0"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"105131f4-3ef0-4601-821e-fe2b73cde5f0"}],"recentChangeFlags":null},{"id":"6df6cecb-2054-4886-9369-7074179000e4","uri":"https://api.sproutsocial.com","name":"api.sproutsocial.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"153d3995-4334-463f-bdf6-2b51a3667f5e","sortOrder":25},"sortOrder":25,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"6df6cecb-2054-4886-9369-7074179000e4"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"e78251ac-8262-45e7-ab6c-7dc442337ff7","name":"Out of scope","targets":[{"id":"a2f5dc0a-06c9-46a9-ba48-07dafa036fc4","uri":null,"name":"*.sproutsocial.com/wp-includes","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c1dea752-188e-4797-adef-097d94362715","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a2f5dc0a-06c9-46a9-ba48-07dafa036fc4"}],"recentChangeFlags":null},{"id":"a65c32f9-4019-448c-9a61-93a927c9c39d","uri":null,"name":"pagely.sproutsocial.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6e27c42d-cca4-497c-ad0d-cca8b2f730d7","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a65c32f9-4019-448c-9a61-93a927c9c39d"}],"recentChangeFlags":null},{"id":"cad3ada0-c9e9-4dec-b5dc-ad3020b13f2e","uri":null,"name":"sproutsocial.com/wp-includes","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f595d12d-7f18-49ae-886f-2db25f7228fc","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cad3ada0-c9e9-4dec-b5dc-ad3020b13f2e"}],"recentChangeFlags":null},{"id":"2f6d536a-ee02-4dca-889d-72972ebfdbf4","uri":null,"name":"jobboard.sproutsocial.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"df518287-f187-433a-99aa-cbaa2e746ad7","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2f6d536a-ee02-4dca-889d-72972ebfdbf4"}],"recentChangeFlags":null},{"id":"068e9aad-a973-4b83-806f-b614d8ca160c","uri":null,"name":"Anything that CNAMEs to a third party","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"77a595a1-5740-4320-b64d-fb32be900428","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"10916ae7-98d9-43d9-8a78-7e55214ebb03","uri":"","name":"cms.sproutsocial.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a95726ba-290f-4ba4-aa68-37888afa9ea7","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"10916ae7-98d9-43d9-8a78-7e55214ebb03"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"b3091ebb-2c08-4a65-a9dc-f7dac52f3b39","code":"sproutsocial","state":"in_progress","endsAt":null,"bountyId":"746b3492-f8d5-464c-9117-26379949e22c","startsAt":"2014-05-03T09:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/a632/efdd/03c414fb/605faeb1806373875a54dd28281c9c34_Sprout_Social_logo.jpeg","logoBackgroundColor":"#000000","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2014-05-03T09:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/sproutsocial","changelogs":"/engagements/sproutsocial/changelog","submissions":null,"announcements":"/engagements/sproutsocial/announcements","hallOfFame":"/engagements/sproutsocial/hall_of_fames","crowdstream":"/engagements/sproutsocial/crowdstream"},"announcementsCount":7,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/sproutsocial/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=sproutsocial\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/sproutsocial/engagement_subscribers","engagementChangelogsUrl":"/engagements/sproutsocial/changelog","publishedAt":"2025-08-20T15:05:51.968Z","engagementChangelogUrl":"/engagements/sproutsocial/changelog/e1ff045a-ef97-4c1d-8847-264067c4188b","createUserFeedbacksUrl":"/engagements/sproutsocial/feedbacks","engagementCrowdstreamUrl":"/engagements/sproutsocial/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}