{"id":"b0e25799-d4d9-47f2-86dc-6b7c2d67772d","engagementId":"8aa82709-632e-4a53-8c69-a5d39c28d37a","data":{"brief":{"id":"ced41736-37a6-49c3-9e69-0ccb524c69aa","name":"Sunrun Vulnerability Disclosure Pro Engagement","tagline":"Life Runs on Clean Energy","description":"\u003cp\u003eSunrun is the leading residential solar, battery storage, and energy services company in the United States. The company focuses on delivering clean, affordable, and reliable energy to households through solar panel installations, home battery systems, and innovative energy management solutions. With a strong presence nationwide, Sunrun develops cutting-edge platforms and customer-facing applications that enable energy independence and smarter consumption.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/p\u003e","industryTagId":"948573e8-bbbb-4552-918a-f87250ebe1fc","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Sunrun not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Sunrun, you can report it here. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003ch2\u003eEngagement Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not exceed 50 requests per second against APIs. Coordinate with Sunrun Security before performing any large-scale or high-volume\ntesting\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eReport Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eReports must contain a clear explanation of the issue, expected vs. actual behavior and the security impact along with detailed steps to reproduce it. If the issue cannot be reliably reproduced based on your report, it may be considered ineligible for a reward\u003c/li\u003e\n\u003cli\u003eDo not submit more than one vulnerability per report. In cases where demonstrating impact requires chaining multiple vulnerabilities together, those can be included in the same report as long as the linkage is clearly explained\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eThe target within scope is publicly accessible.\u003c/p\u003e\n\n\u003ch2\u003eCredentials\u003c/h2\u003e\n\n\u003cp\u003eCredentials are not provided for testing. \u003c/p\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthentication \u0026amp; Session Management (OAuth, NextAuth.js, Google SSO flows)\u003c/li\u003e\n\u003cli\u003eAuthorization \u0026amp; Access Control (validate role-based access, privilege escalation, IDOR risks)\u003c/li\u003e\n\u003cli\u003eData Handling \u0026amp; Privacy (PII storage, Mixpanel cookies, leakage of customer/employee data)\u003c/li\u003e\n\u003cli\u003eApplication Logic (sales dashboards, affiliate portals, pricing engines, reporting tools)\u003c/li\u003e\n\u003cli\u003eError Handling \u0026amp; Information Disclosure (verbose error messages, stack traces, exposed APIs)\u003c/li\u003e\n\u003cli\u003eSecure Configurations (TLS, AWS CloudFront, S3 permissions, caching policies)\u003c/li\u003e\n\u003cli\u003eThird-Party Integrations (analytics, advertising, A/B testing, and tracking scripts)\u003c/li\u003e\n\u003cli\u003eSource Code Review (focus on repos tied to production systems with sensitive data flows)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eN-day/Third party 0-day Policy\u003c/h2\u003e\n\n\u003cp\u003eWhen N-Day bugs are released to the public, we will consider these as in scope after 30 days has gone by\u003cbr\u003e\ne.g: N-day released on 01/01/2025, we would consider it in-scope on 01/31/2025\u003c/p\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eP5 vulnerabilities\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvailability/volumetric testing e.g.:\n\n\u003cul\u003e\n\u003cli\u003eDoS/DDoS/Network DoS\u003c/li\u003e\n\u003cli\u003eRate limiting bypass attempts\u003c/li\u003e\n\u003cli\u003eEmail bombing flooding\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eALL forms of social Engineering\u003c/li\u003e\n\u003cli\u003eAccessing, exfiltrating, or modifying real customer data/PII\u003c/li\u003e\n\u003cli\u003eAutomated scans at high frequency\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via our \u003ca href=\"https://bugcrowd-support.freshdesk.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFreshdesk Portal\u003c/a\u003e before going any further.\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"9af9483f-f0b9-4d46-bc33-7f09eaa9ebb4","name":"In Scope ","targets":[{"id":"eca9d594-faf5-448a-bb33-a91e9eb13903","uri":"https://ai.sunrun.com/","name":"https://ai.sunrun.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9ca3fba9-7c50-4eaa-ab77-a1386ce27c8f","sortOrder":0},"sortOrder":0,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"eca9d594-faf5-448a-bb33-a91e9eb13903"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"eca9d594-faf5-448a-bb33-a91e9eb13903"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"eca9d594-faf5-448a-bb33-a91e9eb13903"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"eca9d594-faf5-448a-bb33-a91e9eb13903"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"eca9d594-faf5-448a-bb33-a91e9eb13903"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"eca9d594-faf5-448a-bb33-a91e9eb13903"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"eca9d594-faf5-448a-bb33-a91e9eb13903"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"eca9d594-faf5-448a-bb33-a91e9eb13903"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"eca9d594-faf5-448a-bb33-a91e9eb13903"}],"recentChangeFlags":null},{"id":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc","uri":"https://sunrunone.com/dashboard","name":"https://sunrunone.com/dashboard","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2c9f18db-8aa9-4fbf-ad4b-83d9f600c388","sortOrder":1},"sortOrder":1,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"3a1f45db-9f66-44f9-a17d-b8b1815b20bc"}],"recentChangeFlags":null},{"id":"2258e529-f323-48a2-9e8e-c1cafcd80a85","uri":"https://www.valuereport.ai.sunrun.com/","name":"https://www.valuereport.ai.sunrun.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"035c22de-d46f-4db2-b656-c64a17ffb745","sortOrder":2},"sortOrder":2,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"2258e529-f323-48a2-9e8e-c1cafcd80a85"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"2258e529-f323-48a2-9e8e-c1cafcd80a85"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"2258e529-f323-48a2-9e8e-c1cafcd80a85"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"2258e529-f323-48a2-9e8e-c1cafcd80a85"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"2258e529-f323-48a2-9e8e-c1cafcd80a85"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"2258e529-f323-48a2-9e8e-c1cafcd80a85"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"2258e529-f323-48a2-9e8e-c1cafcd80a85"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"2258e529-f323-48a2-9e8e-c1cafcd80a85"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"2258e529-f323-48a2-9e8e-c1cafcd80a85"}],"recentChangeFlags":null},{"id":"a571c02c-f204-4b8f-aed0-755d40f4cc22","uri":"https://elephant.ai.sunrun.com/","name":"https://elephant.ai.sunrun.com/","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1caaad8b-760d-43d3-8c2a-76c33e827aae","sortOrder":3},"sortOrder":3,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"a571c02c-f204-4b8f-aed0-755d40f4cc22"}],"recentChangeFlags":null},{"id":"6d720548-2f03-4e96-8484-75fcdba7d31e","uri":"https://www.affiliates.ai.sunrun.com/","name":"https://www.affiliates.ai.sunrun.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ae1bd0f6-878f-47e0-b595-4b278b551ece","sortOrder":4},"sortOrder":4,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"6d720548-2f03-4e96-8484-75fcdba7d31e"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"6d720548-2f03-4e96-8484-75fcdba7d31e"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"6d720548-2f03-4e96-8484-75fcdba7d31e"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"6d720548-2f03-4e96-8484-75fcdba7d31e"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"6d720548-2f03-4e96-8484-75fcdba7d31e"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"6d720548-2f03-4e96-8484-75fcdba7d31e"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"6d720548-2f03-4e96-8484-75fcdba7d31e"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"6d720548-2f03-4e96-8484-75fcdba7d31e"}],"recentChangeFlags":null},{"id":"11a30905-fd72-469e-96db-cefee82f725d","uri":"https://servicetransfer.staging.ai.sunrun.com/","name":"https://servicetransfer.staging.ai.sunrun.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"90da3a73-35da-488d-baf3-3b715257d1cd","sortOrder":5},"sortOrder":5,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"11a30905-fd72-469e-96db-cefee82f725d"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"11a30905-fd72-469e-96db-cefee82f725d"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"11a30905-fd72-469e-96db-cefee82f725d"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"11a30905-fd72-469e-96db-cefee82f725d"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"11a30905-fd72-469e-96db-cefee82f725d"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"11a30905-fd72-469e-96db-cefee82f725d"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"11a30905-fd72-469e-96db-cefee82f725d"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"11a30905-fd72-469e-96db-cefee82f725d"}],"recentChangeFlags":null},{"id":"4915f121-6fa2-457e-ace2-3f2305e493cd","uri":"https://ipa.ai.sunrun.com/","name":"https://ipa.ai.sunrun.com/","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c7d59da2-96aa-4f9c-8fc2-5e71e4bad9d5","sortOrder":6},"sortOrder":6,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"4915f121-6fa2-457e-ace2-3f2305e493cd"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eDescription\u003c/h2\u003e\n\n\u003cp\u003eThe applications in-scope under ai.sunrun.com and related subdomains support a variety of business functions, including customer dashboards, affiliate portals, pricing engines, reporting tools, and service transfer systems. These applications are critical for customer onboarding, energy usage monitoring, financial reporting, and operational workflows.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ewww.sunrun.com – Main corporate website \u003c/li\u003e\n\u003cli\u003esunrunone.com/dashboard – Customer-facing dashboard \u003c/li\u003e\n\u003cli\u003evaluereport.ai.sunrun.com – Reporting/analytics portal \u003c/li\u003e\n\u003cli\u003eelephant.ai.sunrun.com – Internal/customer application \u003c/li\u003e\n\u003cli\u003eaffiliates.ai.sunrun.com – Affiliate Portal \u003c/li\u003e\n\u003cli\u003eservicetransfer.staging.ai.sunrun.com – Service Transfer Center \u003c/li\u003e\n\u003cli\u003eipa.ai.sunrun.com – Internal app (CloudFront-protected, currently 403 response)\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"41d89ac0-4159-493f-b8bc-e9552c8817d0","name":"Out of Scope","targets":[{"id":"97b4e62d-cea7-445f-b2db-7a3ae632053a","uri":"","name":"Third-party SaaS services not owned or managed by Sunrun","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"846ae2b7-6a9d-4fd7-a29a-67f569776846","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"d400ed0c-cea5-47a2-be5e-01c18144be87","uri":"","name":"Vendor-hosted platforms outside direct Sunrun control","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b0f729ad-159a-4e81-b613-f6a61b846146","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"8aa82709-632e-4a53-8c69-a5d39c28d37a","code":"sunrun-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"e347e0d7-80b8-4348-8f0d-ffcc687f5479","startsAt":"2025-09-16T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Consumer Services","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/0339/83e9/2529e6ed/39d683bdf54f869a2833500224e84b7a_sunrun_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-09-16T18:00:02.277Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/sunrun-vdp-pro","changelogs":"/engagements/sunrun-vdp-pro/changelog","submissions":null,"announcements":"/engagements/sunrun-vdp-pro/announcements","hallOfFame":"/engagements/sunrun-vdp-pro/hall_of_fames","crowdstream":"/engagements/sunrun-vdp-pro/crowdstream"},"announcementsCount":5,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/sunrun-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=sunrun-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/sunrun-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/sunrun-vdp-pro/changelog","publishedAt":"2026-09-23T19:10:12.004Z","engagementChangelogUrl":"/engagements/sunrun-vdp-pro/changelog/b0e25799-d4d9-47f2-86dc-6b7c2d67772d","createUserFeedbacksUrl":"/engagements/sunrun-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/sunrun-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}