{"id":"02b46900-9459-4816-9127-17a43d8b3df8","engagementId":"ac64ded8-7b93-45d7-ba7c-da8e48ff1881","data":{"brief":{"id":"5865d25d-922d-4261-af06-77d2d5dfd990","name":"Telstra VDP","tagline":"Submit your finding to Telstra's Vulnerability Disclosure Program","description":"\u003cp\u003eThank you for participating in Telstra Vulnerability Disclosure Program. Telstra takes the security of our systems and our customer data seriously.\u003c/p\u003e\n\n\u003cp\u003eNo technology is perfect and Telstra believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets.\u003c/p\u003e\n\n\u003cp\u003eWe will be onboarding new systems into scope as the program continues. Please stay tuned to the announcements on this page!\u003c/p\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritisation/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003eTesting is only authorised on the targets listed as in scope. Any domain/property of Telstra not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Telstra, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003cp\u003eTelstra utilises and hosts a number of third-party providers and services which may be listed as subdomains of those which are in scope.\u003cbr\u003e\nWe cannot authorise testing against these systems.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eAll targets are publicly facing and do not need additional steps in order to access them.\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAPIs\u003c/li\u003e\n\u003cli\u003eMobile apps\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eCredentials:\u003c/h2\u003e\n\n\u003cp\u003eThis program is set up as an unauthenticated program. The use of personal credentials for testing purposes is strictly prohibited.\u003c/p\u003e\n\n\u003ch2\u003eOut of Scope:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll customer owned services\u003c/li\u003e\n\u003cli\u003eDenial of Service (DoS) or Distributed Denial of Service (DDoS) attacks are not permitted\u003c/li\u003e\n\u003cli\u003eAny attacks which may impact the usability of customer facing services\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eIf you have any questions regarding this matter, please contact support@bugcrowd.com\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNote: Belong submissions should now go via \u003ca href=\"https://bugcrowd.com/engagements/belong-vdp-pro\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003etheir dedicated VDP\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":"\u003ch1\u003eSubmission Requirements\u003c/h1\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCategory\u003c/th\u003e\n\u003cth\u003eSpecification\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eCustom Request Header\u003c/td\u003e\n\u003ctd\u003eX-Bug-Bounty: BugCrowd-\u0026lt;username\u0026gt;\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eAutomated Tooling Rate Limit\u003c/td\u003e\n\u003ctd\u003eMaximum of 5 requests per second\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e"},"scope":[{"id":"570be17c-7800-4874-9453-de2c6627a24c","name":"Telstra - In Scope","targets":[{"id":"f75890fa-31ae-4107-90df-ebee776c3253","uri":"https://www.telstra.com/","name":"https://*.telstra.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9c248ddf-a38d-453a-a76b-74ad6efca588","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"f75890fa-31ae-4107-90df-ebee776c3253"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"f75890fa-31ae-4107-90df-ebee776c3253"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f75890fa-31ae-4107-90df-ebee776c3253"}],"recentChangeFlags":null},{"id":"cbc38e40-b6b7-484c-9500-7c1551b55165","uri":"https://myid.telstra.com","name":"https://myid.telstra.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7ce7915a-2594-40f5-8ee1-5cd6acbbe236","sortOrder":1},"sortOrder":1,"tags":[{"id":"59cdb1e5-8e65-4040-b1eb-c323dfee5a53","name":"Authentication Systems","targetId":"cbc38e40-b6b7-484c-9500-7c1551b55165"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cbc38e40-b6b7-484c-9500-7c1551b55165"}],"recentChangeFlags":null},{"id":"2bc33069-f299-4b16-9e49-045b0dc2c049","uri":"https://purple.telstra.com/","name":"https://purple.telstra.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b6c73c19-b4a9-4746-baf7-ab97235c40f8","sortOrder":2},"sortOrder":2,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"2bc33069-f299-4b16-9e49-045b0dc2c049"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"2bc33069-f299-4b16-9e49-045b0dc2c049"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2bc33069-f299-4b16-9e49-045b0dc2c049"}],"recentChangeFlags":null},{"id":"193cf223-33b1-440a-81eb-dde24aa7c1b1","uri":"https://*.telstra.com.au/","name":"https://*.telstra.com.au/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"480dd9fc-4fea-4d07-b2fc-aeca0c35d068","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"504a2c8d-ca41-4341-9345-075dbdad33d3","uri":"","name":"Telstra APIs","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"175f8633-60f2-45a5-b22b-b6304d22305d","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"504a2c8d-ca41-4341-9345-075dbdad33d3"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"ce702f30-ba3a-4b49-9949-a424cc88e93b","name":"Mobile Targets","targets":[{"id":"23ccf5fb-283f-4332-a494-68b175f90eff","uri":"https://apps.apple.com/au/app/my-telstra/id543829966","name":"My Telstra iOS app","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2384495a-ba44-4b51-ac30-5e7712e8eb24","sortOrder":0},"sortOrder":0,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"23ccf5fb-283f-4332-a494-68b175f90eff"}],"recentChangeFlags":null},{"id":"3bcf2d7b-55bd-4c44-b07f-55c33ddd9db4","uri":"https://play.google.com/store/apps/details?id=com.telstra.mobile.android.mytelstra","name":"My Telstra Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7a45792b-47d0-486e-af6b-1f172028c1a3","sortOrder":1},"sortOrder":1,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"3bcf2d7b-55bd-4c44-b07f-55c33ddd9db4"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"1f98e2e0-5ef9-4be3-842e-3e6a33b9069f","name":"Telstra - Out of Scope","targets":[{"id":"139b6932-8826-42d6-b106-7a74028862c3","uri":"https://*.mobile.telstra.com","name":"*.mobile.telstra.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"64449e19-1cc8-41d0-b4cf-1423c8b6e63f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c8b21328-697d-494f-a54a-252dded5f706","uri":"https://cpe-*.bigpond.net.au","name":"cpe-*.bigpond.net.au","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"84544d82-131a-4ced-8893-90fe1c51dc2d","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"56e45ebe-1d84-4a0e-b856-223e26514a4c","uri":"https://capcpe-*.bigpond.net.au","name":"capcpe-*.bigpond.net.au","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"eca8eb21-0aff-4aed-b596-3d60d58ed195","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"19f42189-83d2-4e0a-85e7-ec9422f84d16","uri":"https://cpe-*.telstra.net","name":"cpe-*.telstra.net","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ea8a2a35-aa2a-493e-b50b-a50840c66109","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"9908c8a6-a3b7-46f2-b0dd-8e51b4752e8a","uri":"https://*.lnk.telstra.net","name":"*.lnk.telstra.net","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"103ac37c-bb41-41ad-860e-563dba4301c3","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"ac64ded8-7b93-45d7-ba7c-da8e48ff1881","code":"telstra-vdp","state":"in_progress","endsAt":null,"bountyId":"df4dc1b9-d80e-4b09-af1c-16de803eee4b","startsAt":"2022-11-08T11:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/0cb1/52d1/c9aa94f5/960b008106a8eebf71e5b128c33c9fa9_Negative-mono-RGB.png","logoBackgroundColor":"#131A35","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2022-11-08T11:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/telstra-vdp","changelogs":"/engagements/telstra-vdp/changelog","submissions":null,"announcements":"/engagements/telstra-vdp/announcements","hallOfFame":"/engagements/telstra-vdp/hall_of_fames","crowdstream":null},"announcementsCount":5,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/telstra-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=telstra-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/telstra-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/telstra-vdp/changelog","publishedAt":"2025-10-09T22:29:55.412Z","engagementChangelogUrl":"/engagements/telstra-vdp/changelog/02b46900-9459-4816-9127-17a43d8b3df8","createUserFeedbacksUrl":"/engagements/telstra-vdp/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}