{"id":"dcb212c3-8370-492c-803f-81a364c230df","engagementId":"b842e54b-bdd5-4c5d-ac02-d433341c60d3","data":{"brief":{"id":"51ebe36a-3948-46f5-b345-f20f98ec4962","name":"Square","tagline":"We make selling simple for businesses of all sizes.","description":"\u003ch2\u003eBlock, Inc.\u003c/h2\u003e\n\n\u003cp\u003eIn 2021, Square officially changed its name to Block with Square now being one of our product lines. The Square Bug Bounty program is limited to this line of business and includes the target components outlined in the ‘Target Information’ section.  \u003c/p\u003e\n\n\u003cp\u003eBlock engages with Bugcrowd to provide proactive security testing across the majority of our other product lines. Please reach out to support@bugcrowd.com if you have any questions.\u003c/p\u003e\n\n\u003cp\u003eYou can participate in our other product bug bounty programs as noted below:\u003c/p\u003e\n\n\u003cp\u003e\u003ca href=\"https://bugcrowd.com/cashapp?preview=741329c7a958c6d3ce61ac7970eb2ab7\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCash App\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/tidal-bugbounty?preview=f39b37c04ea03ee111302f7ae385f67c\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTidal\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/afterpay\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAfterpay\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/engagements/blockopensource\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBlock Open Source\u003c/a\u003e\u003c/p\u003e\n\n\u003ch2\u003eSerious about security\u003c/h2\u003e\n\n\u003cp\u003eOur approach to security is designed to protect buyers and sellers. We monitor every transaction, continuously innovate in fraud prevention, and we protect businesses’ data like our business depends on it—because it does. We adhere to industry-leading standards to manage our network, secure our web and client applications, and set policies across our organization.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings and rewards\u003c/h2\u003e\n\n\u003cp\u003eOnly Critical (P1), Severe (P2), and Moderate (P3) submissions will be rewarded. \u003cstrong\u003eP4 findings will NOT be accepted.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eA Bugcrowd account is required. Please sign up for a Square account using your @bugcrowdninja.com email address only. Do not use personal email addresses. If for any reason your Square seller account gets deactivated during testing, please escalate to Bugcrowd. Do not create multiple merchant accounts as this can be disruptive.\u003c/p\u003e\n\n\u003cp\u003eIf your testing requires two separate Square accounts, please add \"+1\" to your email address for the secondary account. Using your @bugcrowdninja.com address helps us identify you.\u003c/p\u003e\n\n\u003cp\u003eFor more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. \u003c/p\u003e\n\n\u003ch2\u003eRules of Engagement\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eIf you are able to access or modify personal data of Square customers or other sensitive data, immediately contact Block - do not attempt to conduct post-exploitation work.\u003c/li\u003e\n\u003cli\u003eDo not use, share, publish, or disclose information obtained in the course of identifying issues. After submitting you must delete, purge, and/or destroy all copies of information or digital samples.\u003c/li\u003e\n\u003cli\u003eFor test merchant accounts, please do not sign up for Text Message Marketing (TMM) or Messages Plus (M+) products as both are used for verification of business. This would have negative impact with our carriers. If you have any questions on our third party products, we encourage you to reach out.\u003c/li\u003e\n\u003cli\u003eDo not attempt a denial-of-service attack.\u003c/li\u003e\n\u003cli\u003eFor hardware testing, research must be done on one's own Square Register or Terminal.\u003c/li\u003e\n\u003cli\u003eDo not use ChatGPT, DeepSeek, Google Gemini or any AI tools during your research. You may not disclose any information within these platforms.\u003c/li\u003e\n\u003cli\u003ePlease contact support@bugcrowd.com for any escalations. Do not contact Block or Block aliases to follow up on submissions. Doing so can result in point reduction or program expulsion.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eFlaws within payments or checkout flows, especially findings that may expose personal information\u003c/li\u003e\n\u003cli\u003eSquare Banking (see \u003ca href=\"https://squareup.com/banking\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eIssues in our hardware or firmware of Square's point of sale (POS) systems\u003c/li\u003e\n\u003c/ul\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003cp\u003eAny finding or (sub)domain that is not listed in scope but is confirmed owned by Block may be accepted upon review. We will not accept submissions outside of this line of business (Square) that is for another product line (Cash, Afterpay, Tidal).\u003c/p\u003e\n\n\u003ch3\u003eSubdomain Takeovers\u003c/h3\u003e\n\n\u003cp\u003ePayouts for Subdomain Takeover findings differ from the rewards listed above. Please review the severity and descriptions below before submitting a report.\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eImpact\u003c/th\u003e\n\u003cth\u003eSeverity\u003c/th\u003e\n\u003cth\u003eReward\u003c/th\u003e\n\u003cth\u003eDescription\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eHigh Impact Subdomain Takeover\u003c/td\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003ctd\u003e$1,000 - $5,000\u003c/td\u003e\n\u003ctd\u003eRewarded for domains and subdomains with reputational or technical risk. Also for subdomains under a parent domain with reputational or technical risk, and access to sensitive data on that parent domain.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBasic Subdomain Takeover\u003c/td\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003e$250 - $500\u003c/td\u003e\n\u003ctd\u003eRewarded for domains and subdomains under a parent domain with reputational or technical risk, but without access to sensitive data on that parent domain.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eMX Takeover (Mailgun)\u003c/td\u003e\n\u003ctd\u003eN/A\u003c/td\u003e\n\u003ctd\u003eN/A\u003c/td\u003e\n\u003ctd\u003eNot rewardable unless the domain or subdomain is \u003cem\u003everified\u003c/em\u003e within Mailgun and one can send an actual message. If valid, please provide full header information.\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ch3\u003eHardware Testing\u003c/h3\u003e\n\n\u003cp\u003eTesting and research must be done on one's own Square Register or Terminal. If you find any security vulnerability related to our hardware assets, please submit a report.\u003c/p\u003e\n\n\u003ch2\u003eKnown Issues\u003c/h2\u003e\n\n\u003ch3\u003eStaff Permissions\u003c/h3\u003e\n\n\u003cp\u003eVulnerabilities \u003cstrong\u003ewill not be accepted\u003c/strong\u003e when they involve scenarios where:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eEmployee A exceeds their authorized access level to perform actions within merchant accounts\u003c/li\u003e\n\u003cli\u003eOne employee attacks another employee's account or access privileges\u003c/li\u003e\n\u003cli\u003eInternal team members gain unauthorized access to owner-level functions or data\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eiFrame Injections found at Square Dashboard\u003c/h3\u003e\n\n\u003cp\u003eCurrent Status: The team is developing a systematic fix to block all unauthorized iframe injections across the platform.\u003c/p\u003e\n\n\u003ch3\u003eInfo Stealer Logs\u003c/h3\u003e\n\n\u003cp\u003eBlock is aware of credentials obtained from stealer log malware. While we encourage researchers to submit findings that impact Block or Block customers, we reserve the right to treat each submission and reward on a case by case basis. Payout may not align with our standard payout scheme.\u003c/p\u003e\n\n\u003ch2\u003eSubmission Quality\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDetailed steps for reproducing the bug - please include any screenshots, links you clicked on, pages visited, etc., we prefer detailed reproduction steps and video demos.\u003c/li\u003e\n\u003cli\u003eDescribe the versions of all relevant components of the attack (eg browser, OS, mobile app version).\u003c/li\u003e\n\u003cli\u003eDescribe a concrete attack scenario. How will the problem impact Block or Square buyers/sellers? Put the problem into context and demonstrate with clear evidence.\u003c/li\u003e\n\u003cli\u003eConsolidate similar issues into a single report, especially if they affect multiple locations (e.g., an authorization bypass on several endpoints). This streamlines our triage, speeds processing, and allows for holistic evaluation and reward.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eThird Party Vendor Policy\u003c/h2\u003e\n\n\u003cp\u003eThird party submissions will be considered Out of Scope. With that said, if you believe you’ve identified an issue with one of our third-party service providers as a result of Square’s misconfiguration or insecure usage of that service, we’d appreciate you reaching out.\u003c/p\u003e\n\n\u003cp\u003ePlease keep in mind that any report regarding third-party services are likely to NOT be eligible for a reward – both cash and kudos points.\u003c/p\u003e\n\n\u003ch2\u003eProgram Exclusions\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny target that is covered under another Block bug bounty program (e.g. Cash App, Tidal, Afterpay) including those covered under Private programs\u003c/li\u003e\n\u003cli\u003eAny vulnerabilities found in third-party software\u003c/li\u003e\n\u003cli\u003eAny physical attempts against Block property or data centers\u003c/li\u003e\n\u003cli\u003eHijacking or installing a third-party app to attack the Square platform\u003c/li\u003e\n\u003cli\u003eAny research findings involving an attempt to view, modify, access, disclose, exfiltrate, use, or damage data belonging to Square, its customers, or others.\u003c/li\u003e\n\u003cli\u003eInvoices found online via a web archive or malware assessment services (virustotal.com, alienvault.com. URLscan.io, etc.); invoice links are set to expire and were uploaded by users, this is not within our control\u003c/li\u003e\n\u003cli\u003eVulnerabilities involving prompt injection attacks (jailbreaking) or prompt disclosure (prompt leaking) \u003c/li\u003e\n\u003cli\u003ePrompt injection that allows arbitrary prompts to be answered without demonstrated security impact\u003c/li\u003e\n\u003cli\u003eSelf-inflicted prompt injection vulnerabilities such as XSS without demonstrated security impact\u003c/li\u003e\n\u003cli\u003eReported vulnerabilities within Team Permissions (squareup.com/dashboard/team/permissions) involving XSS, Broken Access Control, IDOR, Sensitive Data Exposure, etc. (i.e. Employee A has exceeded their access to perform certain actions within a merchant account or attacked Employee B) will not be accepted.\u003c/li\u003e\n\u003cli\u003eLogout CSRF\u003c/li\u003e\n\u003cli\u003eLack of rate limiting\u003c/li\u003e\n\u003cli\u003eContent Spoofing \u0026gt; Impersonation via Broken Link Hijacking\u003c/li\u003e\n\u003cli\u003ePresence of autocomplete attribute on web forms\u003c/li\u003e\n\u003cli\u003eMissing cookie flags on non-sensitive cookies\u003c/li\u003e\n\u003cli\u003eNo maximum password length\u003c/li\u003e\n\u003cli\u003eExposure of public keys (these are designed to be public, please review the type of encryption key before reporting it)\u003c/li\u003e\n\u003cli\u003eAn oracle that discloses whether a given username, email address, or phone number is associated with an actual account (However, please do submit anything that allows you to recover usernames en masse)\u003c/li\u003e\n\u003cli\u003eUsing spoofed emails for phishing\u003c/li\u003e\n\u003cli\u003eReports of the 2-factor token not expiring, we use TOTP codes for 2-factor\u003c/li\u003e\n\u003cli\u003eAny research, data access or testing that violates the law\u003c/li\u003e\n\u003cli\u003eCache poisoning resulting in DoS\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.sellercommunity.com/t5/Seller-Community-US/ct-p/Seller_Community_US?profile.language=en\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSquare Seller Community\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eP4 submissions will not be accepted \u003cem\u003e(If any P4 submissions are submitted, they will not be triaged and will be marked as N/A)\u003c/em\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eDisclosure Procedures\u003c/h2\u003e\n\n\u003cp\u003eBlock recognizes the important contributions the security research community can make. We do not publicly disclose vulnerabilities by default. We take the security of our services very seriously and monitor their use for indications of a malicious attack. In order to distinguish legitimate security research from malicious attacks against our services, we promise not to bring legal action against researchers who:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eShare with us the full details of any problem found.\u003c/li\u003e\n\u003cli\u003eDo not disclose the issue to others until we’ve had a reasonable time to address it and disclosure has been approved by us.\u003c/li\u003e\n\u003cli\u003eDo not intentionally harm the experience or usefulness of the service to others.\u003c/li\u003e\n\u003cli\u003eNever attempt to view, modify, access, disclose, exfiltrate, use or damage data belonging to Block, its customers, or others.\u003c/li\u003e\n\u003cli\u003eDo not attempt a denial-of-service attack.\u003c/li\u003e\n\u003cli\u003eDo not perform any research or testing in violation of the law.\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"76f3ea40-0491-41f7-8f32-071284bee15c","name":"██████","targets":[{"id":"f41de892-e86b-4f8c-853b-f3de22775faf","uri":null,"name":"████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5eafde25-d0e1-4e2f-a411-698fc669a0b4","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"f41de892-e86b-4f8c-853b-f3de22775faf"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"f41de892-e86b-4f8c-853b-f3de22775faf"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"f41de892-e86b-4f8c-853b-f3de22775faf"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f41de892-e86b-4f8c-853b-f3de22775faf"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"f41de892-e86b-4f8c-853b-f3de22775faf"}],"recentChangeFlags":null},{"id":"db5bde21-6fe9-454b-883c-2061e19865fb","uri":null,"name":"██████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b99df8a4-3d7b-4bcb-a1b7-723362282599","sortOrder":1},"sortOrder":1,"tags":[{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"db5bde21-6fe9-454b-883c-2061e19865fb"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"db5bde21-6fe9-454b-883c-2061e19865fb"},{"id":"53917c1d-52c8-41f3-86f5-166e787ece8f","name":"Select2","targetId":"db5bde21-6fe9-454b-883c-2061e19865fb"},{"id":"9f26f47e-4acd-4d8d-aad2-414b6b367eb0","name":"Handlebars","targetId":"db5bde21-6fe9-454b-883c-2061e19865fb"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"db5bde21-6fe9-454b-883c-2061e19865fb"},{"id":"c3412833-26e7-4bbd-907f-760d9da61232","name":"Newrelic","targetId":"db5bde21-6fe9-454b-883c-2061e19865fb"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"db5bde21-6fe9-454b-883c-2061e19865fb"}],"recentChangeFlags":null},{"id":"f5023263-2da3-422d-a54e-3a6b7b7a988e","uri":null,"name":"█████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"eb243373-0b96-42e0-9a3e-90ddf85766e6","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f5023263-2da3-422d-a54e-3a6b7b7a988e"}],"recentChangeFlags":null},{"id":"40a4e90b-6903-4445-8512-c614451525de","uri":null,"name":"███████████████████████████████████████████████████","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9b085453-bf92-41b2-9fa1-a6d1d6d75a12","sortOrder":4},"sortOrder":4,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"40a4e90b-6903-4445-8512-c614451525de"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"40a4e90b-6903-4445-8512-c614451525de"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"40a4e90b-6903-4445-8512-c614451525de"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"40a4e90b-6903-4445-8512-c614451525de"}],"recentChangeFlags":null},{"id":"a3ebebef-a8f1-4592-9bbb-4795360e4d76","uri":null,"name":"███████████████████████████████████████████████","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2c16f728-f3e5-4560-b366-39810deff530","sortOrder":5},"sortOrder":5,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"a3ebebef-a8f1-4592-9bbb-4795360e4d76"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"a3ebebef-a8f1-4592-9bbb-4795360e4d76"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"a3ebebef-a8f1-4592-9bbb-4795360e4d76"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"a3ebebef-a8f1-4592-9bbb-4795360e4d76"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"a3ebebef-a8f1-4592-9bbb-4795360e4d76"}],"recentChangeFlags":null},{"id":"fc932168-f535-4e5f-97a2-ed28951b3eb3","uri":null,"name":"███████████████","category":"hardware","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b1e3b255-2dbc-43b3-821e-8905685749c2","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"646e6daf-e9e9-43aa-a26c-d7840e64304f","uri":null,"name":"███████████████","category":"hardware","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"977081cc-4765-49ad-91a2-f2ee9d1b4dee","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"4331f62f-2b79-45d2-8e9a-8a77d539594b","p1MaxCents":1800000,"p1MinCents":500000,"p2MaxCents":500000,"p2MinCents":100000,"p3MaxCents":100000,"p3MinCents":25000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████","rewardRangeData":{"1":{"min":5000,"max":18000},"2":{"min":1000,"max":5000},"3":{"min":250,"max":1000},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"e3112936-1b18-4ba7-88e9-dda2e7093e3e","name":"██████","targets":[{"id":"141bf3a5-b4af-401d-999a-ad7b864ed0d0","uri":null,"name":"██████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"423f09f2-aae0-467b-bfed-e57e99a7cb07","sortOrder":0},"sortOrder":0,"tags":[{"id":"510c67d2-8610-428f-aa3e-0f0aa0a808e8","name":"Mustache","targetId":"141bf3a5-b4af-401d-999a-ad7b864ed0d0"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"141bf3a5-b4af-401d-999a-ad7b864ed0d0"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"141bf3a5-b4af-401d-999a-ad7b864ed0d0"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"141bf3a5-b4af-401d-999a-ad7b864ed0d0"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"141bf3a5-b4af-401d-999a-ad7b864ed0d0"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"141bf3a5-b4af-401d-999a-ad7b864ed0d0"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"2f6e1d7b-4fbe-405a-87be-715efc4deb0b","p1MaxCents":1800000,"p1MinCents":500000,"p2MaxCents":500000,"p2MinCents":100000,"p3MaxCents":null,"p3MinCents":null,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":5000,"max":18000},"2":{"min":1000,"max":5000},"3":{"min":null,"max":null},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"6ad65ba8-1f4c-4dc4-8ba3-a33235be8d2c","name":"████████████","targets":[{"id":"d67090d4-d728-4778-9b15-b949a6e465bc","uri":null,"name":"██████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"31c27a3c-6160-4cf9-9c4b-13ac806a9f9c","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"d67090d4-d728-4778-9b15-b949a6e465bc"}],"recentChangeFlags":null},{"id":"42bb7447-7a62-4009-b2a9-798cd1ecb6a5","uri":null,"name":"█████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"345c30c0-f6a0-4740-8a02-e4a187b5d2a7","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"42bb7447-7a62-4009-b2a9-798cd1ecb6a5"}],"recentChangeFlags":null},{"id":"01ca54db-d1f5-4a03-864a-eb23eea1e0b6","uri":null,"name":"████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"89b4c978-c1e0-4a8f-b649-7f3a6b505ad1","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"01ca54db-d1f5-4a03-864a-eb23eea1e0b6"}],"recentChangeFlags":null},{"id":"5411a111-c12f-451f-8bc9-91e100149cb3","uri":null,"name":"███████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"602518e8-7cc2-49b4-b377-0d71968101cf","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5411a111-c12f-451f-8bc9-91e100149cb3"}],"recentChangeFlags":null},{"id":"c7ff51cd-2e37-48db-9495-40ac1d0fdc13","uri":null,"name":"█████████████████████████████████████████████████████████","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3be0e22a-58c9-449c-bfdf-e36117e12305","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"1aa021c1-69dd-410a-bd3f-51baa5739b4d","uri":null,"name":"███████████████████████","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3f0a9872-f30b-47f7-a908-0836167059d0","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1aa021c1-69dd-410a-bd3f-51baa5739b4d"}],"recentChangeFlags":null},{"id":"177b1d6a-87b9-41d0-9646-b2e392e091e3","uri":null,"name":"███████████████████████████████████████","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3f671518-9343-4a77-9499-4bb99a7c2e74","sortOrder":6},"sortOrder":6,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"177b1d6a-87b9-41d0-9646-b2e392e091e3"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"177b1d6a-87b9-41d0-9646-b2e392e091e3"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"177b1d6a-87b9-41d0-9646-b2e392e091e3"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"177b1d6a-87b9-41d0-9646-b2e392e091e3"}],"recentChangeFlags":null},{"id":"e1cf3828-a25d-4b45-9e81-a89aace8c67f","uri":null,"name":"███████████████████████████████████","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f33347f1-8bdf-41b6-97f8-be3038de29cb","sortOrder":7},"sortOrder":7,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"e1cf3828-a25d-4b45-9e81-a89aace8c67f"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"e1cf3828-a25d-4b45-9e81-a89aace8c67f"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"e1cf3828-a25d-4b45-9e81-a89aace8c67f"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"e1cf3828-a25d-4b45-9e81-a89aace8c67f"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"e1cf3828-a25d-4b45-9e81-a89aace8c67f"}],"recentChangeFlags":null},{"id":"61444458-786c-4c09-824f-d17004b4880d","uri":null,"name":"█████████████████████████████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f7acfc0b-3a94-49fb-92a9-675e216ceda0","sortOrder":8},"sortOrder":8,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"61444458-786c-4c09-824f-d17004b4880d"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"b842e54b-bdd5-4c5d-ac02-d433341c60d3","code":"square","state":"in_progress_paused","endsAt":null,"bountyId":"da25f60e-161b-4371-8b2a-37c3dac6eefe","startsAt":"2018-02-21T16:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/engagement_brief_logos/engagement_brief/logo/51ebe36a-3948-46f5-b345-f20f98ec4962/8ab1f416-fc3f-4718-a966-659c9800c993.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":"This engagement is paused until further notice and will not reopen.","lastTransitionAt":"2026-10-01T05:59:28.106Z","cancellationReason":null,"statusLabel":"In progress paused","routesPaths":{"brief":"/engagements/square","changelogs":"/engagements/square/changelog","submissions":null,"announcements":"/engagements/square/announcements","hallOfFame":"/engagements/square/hall_of_fames","crowdstream":null},"announcementsCount":8,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":null,"methodologyUrl":null,"progressPercentage":0,"badgeVariant":"updated","userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=square\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/square/engagement_subscribers","engagementChangelogsUrl":"/engagements/square/changelog","publishedAt":"2026-10-01T05:59:28.142Z","engagementChangelogUrl":"/engagements/square/changelog/dcb212c3-8370-492c-803f-81a364c230df","createUserFeedbacksUrl":"/engagements/square/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}