{"id":"03044428-9524-46e6-8fb4-7b16a7a9032f","engagementId":"27f0fc18-3521-4376-9f35-846d667f8296","data":{"brief":{"id":"aad4bc2d-aff2-493e-8304-a326c5ba2227","name":"TheFork Managed Bug Bounty Engagement","tagline":"TheFork","description":"\u003cp\u003eTheFork, also known as La Fourchette, is a premier real-time restaurant reservation platform, providing users with access to over 60,000 dining establishments across various countries, including France, Spain, Switzerland, Belgium, Italy, Sweden, and many more. TheFork empowers users to discover and book restaurants at any time, ensuring seamless access to a diverse range of dining experiences, from casual meals to gourmet dining, all at the best available prices.\u003c/p\u003e\n\n\u003cp\u003eWith an extensive and growing database of over 20 million verified user reviews, TheFork helps diners make well-informed decisions by offering insights into restaurant quality, service, ambiance, and pricing. Whether users are looking for a local favorite or an international hotspot, TheFork’s intuitive platform simplifies the process of finding and securing reservations, catering to both spontaneous and planned outings.\u003c/p\u003e\n\n\u003cp\u003eBeyond simply offering a reservation service, TheFork is designed to enhance the overall dining experience by providing users with exclusive offers, discounts, and promotions at selected restaurants, making dining out more accessible and affordable. Additionally, the platform includes a loyalty program that rewards frequent users with points (Yums) that can be redeemed for discounts on future reservations.\u003c/p\u003e\n\n\u003cp\u003eThis program specifically focuses on testing TheFork’s B2C website and mobile app, ensuring that the platform remains secure, reliable, and user-friendly. Regular testing helps to maintain a high standard of performance and user experience while safeguarding the platform from potential vulnerabilities, ensuring that both diners and restaurant partners continue to benefit from a seamless and trusted service. Good luck, and happy hunting! \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eGeneral Program Rules (please read carefully)\u003c/h2\u003e\n\n\u003cp\u003eViolating program rules may result in your bounty being omitted.\u003c/p\u003e\n\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003eUSE ONLY TEST RESTAURANTS. It is imperative to understand that testing on live production restaurants or their systems is strictly prohibited without exception. Failure to adhere to this policy will not be tolerated and will result in program ban.\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\n\u003cul\u003e\n\u003cli\u003eIdentify your activity as belonging to Bugcrowd, whether you are performing manual testing or using automated tools:\n\n\u003cul\u003e\n\u003cli\u003eInclude the string \"bugcrowd\" in your User-Agent\u003c/li\u003e\n\u003cli\u003eAdd \"bugcrowd\" to one of the fields of any form post not requiring account information\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eDo not contact other customers / users of the site. Do not attack or interact with any user account that you do not expressly own.\u003c/li\u003e\n\u003cli\u003eLimit excessive automated testing. Automated testing should not exceed 25 requests / second.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e (please see below for any exceptions). However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"c85cd17d-3c78-44ca-a00b-40aff928e114","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of TheFork not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to TheFork, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eGeneral Program Rules (please read carefully)\u003c/h2\u003e\n\n\u003cp\u003eViolating program rules may result in your bounty being omitted.\u003c/p\u003e\n\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003eUSE ONLY TEST RESTAURANTS. It is imperative to understand that testing on live production restaurants or their systems is strictly prohibited without exception. Failure to adhere to this policy will not be tolerated and will result in program ban.\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\n\u003cul\u003e\n\u003cli\u003eIdentify your activity as belonging to Bugcrowd, whether you are performing manual testing or using automated tools:\n\n\u003cul\u003e\n\u003cli\u003eInclude the string \"bugcrowd\" in your User-Agent\u003c/li\u003e\n\u003cli\u003eAdd \"bugcrowd\" to one of the fields of any form post not requiring account information\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eDo not contact other customers / users of the site. Do not attack or interact with any user account that you do not expressly own.\u003c/li\u003e\n\u003cli\u003eLimit excessive automated testing. Automated testing should not exceed 25 requests / second.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003ch3\u003eConsumer Platform (B2C) Access\u003c/h3\u003e\n\n\u003cp\u003ePlease sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eTest Restaurants\u003c/strong\u003e: 500 test restaurants are ready to be used for testing. You can find the complete list in the program resources section on Bugcrowd platform.\u003c/p\u003e\n\n\u003ch4\u003ePayment Testing (TFPay)\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003ePayment functionality in TFPay only opens for the specific booking once your dining time has started and stays open for a maximum of 3hrs\u003c/li\u003e\n\u003cli\u003eTo perform test payments, you must have logged in to the mobile app with an @bugcrowd.com or @bugcrowdninja.com email account\u003c/li\u003e\n\u003cli\u003eNavigate to TheFork pay section through the menu in the app, add test credit cards \u0026amp; gift cards or select the relevant booking\u003c/li\u003e\n\u003cli\u003eComplete the payment. Note a maximum of 2 payments per reservation is allowed\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eCustomer Semi-logged Information\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eTheFork allows booking only with an e-mail address + First name + Last name + Phone number\u003c/li\u003e\n\u003cli\u003eEmail addresses and phone numbers are not validated for ownership\u003c/li\u003e\n\u003cli\u003eIt's possible to know if an e-mail address is registered or not in TheFork\u003c/li\u003e\n\u003cli\u003eIt's possible to book with an e-mail address you don't own\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eBusiness Platform (B2B) Access\u003c/h3\u003e\n\n\u003cp\u003eUse credentials provided by TheFork inside the file\u003c/p\u003e\n\n\u003cblockquote\u003e\n\u003cp\u003ePlease DON'T change the restaurant password\u003c/p\u003e\n\u003c/blockquote\u003e\n\n\u003ch4\u003eTechnical Notes (B2B)\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eJWT TTL is 5 minutes. Session invalidation occurs 5 minutes after logout or password reset\u003c/li\u003e\n\u003cli\u003eAPI testing should be performed from a black box perspective (no documentation available)\u003c/li\u003e\n\u003cli\u003eRedirection to out-of-scope domains (*.theforkmanager.com) may occur during authentication, but testing should remain within listed scope\u003c/li\u003e\n\u003cli\u003eFor some actions the platform requires an OTP sent to the restaurant email address. We are working on providing a static OTP that can be used to test those functionalities.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eReporting\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eSubmissions should include full HTTP request and response\u003c/li\u003e\n\u003cli\u003eSubmissions should contain demonstrated practical impact and attack scenario\u003c/li\u003e\n\u003cli\u003eFinal decisions on vulnerability priority and bounty amount are made by TheFork security team for each report individually\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eReward Classifications\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eDeveloper Portal (developer.thefork.io)\u003c/strong\u003e: All security issues will be ranked as P4\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCross-Platform Issues\u003c/strong\u003e: Vulnerabilities affecting both B2C and B2B systems may receive higher priority consideration\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eLegacy vs Primary Systems\u003c/strong\u003e: Primary APIs receive standard rewards; legacy systems may have reduced rewards\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003ch3\u003eConsumer Platform (B2C) Specific\u003c/h3\u003e\n\n\u003cp\u003e\u003cstrong\u003eAccount \u0026amp; Authentication:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eUser account manipulation and privilege escalation\u003c/li\u003e\n\u003cli\u003eAuthentication bypass and session management\u003c/li\u003e\n\u003cli\u003ePassword reset functionality\u003c/li\u003e\n\u003cli\u003ePermissions and authorization flaws\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003ePayment \u0026amp; Features:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCredit card processing and storage\u003c/li\u003e\n\u003cli\u003ePay at the table (TFPay) functionality\u003c/li\u003e\n\u003cli\u003eGiftcard handling and validation\u003c/li\u003e\n\u003cli\u003eYums loyalty system vulnerabilities\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eCommon Web Vulnerabilities:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eXSS, CSRF, IDOR, SQL/NoSQL Injection\u003c/li\u003e\n\u003cli\u003eJWT and GraphQL implementation flaws\u003c/li\u003e\n\u003cli\u003ePII (Personally Identifiable Information) exposure\u003c/li\u003e\n\u003cli\u003eAccess to internal infrastructure \u0026amp; corporate tools\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eBusiness Platform (B2B) Specific\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eUser account manipulation and privilege escalation\u003c/li\u003e\n\u003cli\u003eAuthentication\u003c/li\u003e\n\u003cli\u003ePII (Personally Identifiable Information) exposure\u003c/li\u003e\n\u003cli\u003eJWT and GraphQL\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eCross-Platform Security\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eData leakage between B2C and B2B systems\u003c/li\u003e\n\u003cli\u003ePrivilege escalation from B2C to B2B or vice versa\u003c/li\u003e\n\u003cli\u003eShared authentication vulnerabilities\u003c/li\u003e\n\u003cli\u003eCross-platform data exposure\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eImportant Testing Notes\u003c/h2\u003e\n\n\u003ch3\u003eWhat's Considered Expected Behavior (Not Vulnerabilities)\u003c/h3\u003e\n\n\u003cp\u003e\u003cstrong\u003eCustomer Data Model:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eThe following behaviors are intentional design choices and are not considered security vulnerabilities. Reports relying solely on these behaviors - without demonstrating additional impact or unauthorized access to non-public data - will be closed.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eBooking Flow:\u003c/strong\u003e The booking process requires only an email, name, and phone number. Ownership verification is not performed. It is expected that users can submit details they do not own, and it is expected that email addresses can be checked for registration status.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSystem-Generated Data:\u003c/strong\u003e When viewing system-level customer profile or booking information (e.g., via internal booking management tools), data is intentionally obfuscated (first initial of first/last name, partially masked phone number, Yums balance).\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eException for User-Generated Content:\u003c/strong\u003e This policy regarding obfuscation \u003cstrong\u003edoes not apply to public-facing content\u003c/strong\u003e that users voluntarily publish, such as public restaurant reviews. Disclosure of first names within publicly viewable reviews is intended functionality.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eWe are interested in vulnerabilities that allow the mass extraction of non-public PII, not the collection of information that users have intentionally chosen to make public on the platform.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eSession Management:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e5-minute delay for session invalidation after logout/password reset is expected\u003c/li\u003e\n\u003cli\u003eWeak password policies are not considered vulnerabilities\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eTemporary Classifications:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eIDORs\u003c/strong\u003e: Currently ranked as P5 Informational (for B2C, B2B is ranked as usual)\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eBACs\u003c/strong\u003e: Currently ranked as P5 Informational (fix in progress)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExclusions\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eSession invalidation can take 5mins when user logout or reset his password\u003c/li\u003e\n\u003cli\u003eWeak Password Policy\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAll lafourchette.com domains are out of scope\u003c/strong\u003e (api.lafourchette.com, Review-api.lafourchette.com, M-api.lafourchette.com, etc.)\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOther TheFork brand domains are out of scope\u003c/strong\u003e (www.lafourchette.com, www.eltenedor.es, www.thefork.* variants not explicitly listed)\u003c/li\u003e\n\u003cli\u003eDoS / DDoS attacks of any kind\u003c/li\u003e\n\u003cli\u003eSocial engineering attacks of any kind\u003c/li\u003e\n\u003cli\u003eExploits around mass content submission, account creation or spamming\u003c/li\u003e\n\u003cli\u003eContent fraud - example: inflating or deflating a restaurant's rating, or raising a review's helpful vote count\u003c/li\u003e\n\u003cli\u003eLack of rate-limit\u003c/li\u003e\n\u003cli\u003eExploits that require warranty voiding actions (e.g., rooting victim device)\u003c/li\u003e\n\u003cli\u003eExploits against the site from webviews within mobile applications NOT published by TheFork\u003c/li\u003e\n\u003cli\u003eMobile application vulnerabilities that require having a malicious application installed will have drastically reduced priority class because of prerequisite\u003c/li\u003e\n\u003cli\u003eHTTP Header security related findings such as missing headers\u003c/li\u003e\n\u003cli\u003eInformation-stealer logs / exposed credentials that has no access to the internal resources. Please note that, info-stealer logs may be accepted if the detected credential can be used for accessing internal resources.\u003c/li\u003e\n\u003cli\u003eDomains that do not send email are not eligible for rewards relating to email misconfiguration (e.g. DMARC misconfiguration)\u003c/li\u003e\n\u003cli\u003eSSL related issues are out-of-scope\u003c/li\u003e\n\u003cli\u003eAll vulnerabilities related to 3rd parties outside of TheFork. Example - Stripe, Amilon\u003c/li\u003e\n\u003cli\u003eAll findings regarding hijacking of 3rd party or any domain / social media in which TheFork is not the direct responsible (Social Broken Link)\u003c/li\u003e\n\u003cli\u003eContacting or requesting customer support services (e.g. phone support, support chat, email support). If you have questions while testing, refer to the \u003ca href=\"https://support.theforkmanager.com/s/?language=en_US\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTheFork FAQ Page\u003c/a\u003e or contact \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eIDORs are temporary going to be considered as P5 Informational. We are aware of an issue linked to such vulnerability, the fix is in progress.\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBACs are temporary going to be considered as P5 Informational. We are aware of an issue linked to such vulnerability, the fix is in progress.\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAll findings regarding hijacking of 3rd party or any domain / social media in which TheFork is not the direct responsible (Social Broken Link) will be ranked as INFORMATIONAL.\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"4de70c27-7b1d-4d12-9340-3385f04aea2d","name":"B2B","targets":[{"id":"0a2db7e0-19cf-447f-9251-723e224446dc","uri":"https://manager.thefork.com","name":" manager.thefork.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fcc6c024-7f2c-463d-a1bf-8686940297e8","sortOrder":0},"sortOrder":0,"tags":[{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"0a2db7e0-19cf-447f-9251-723e224446dc"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0a2db7e0-19cf-447f-9251-723e224446dc"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"0a2db7e0-19cf-447f-9251-723e224446dc"}],"recentChangeFlags":null},{"id":"efc5c65a-fc40-4b3c-bef0-4cf631c15050","uri":"https://apps.apple.com/app/thefork-manager-neo/id1295795281","name":"TheFork Manager iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0ffac0d4-ab80-44e1-9863-8b3027758df2","sortOrder":1},"sortOrder":1,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"efc5c65a-fc40-4b3c-bef0-4cf631c15050"}],"recentChangeFlags":null},{"id":"ac697758-1d55-421a-a83c-a253a1d1da11","uri":"https://play.google.com/store/apps/details?id=com.lafourchette.tfm3","name":"TheFork Manager Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5d9846a8-69e8-4f44-9690-637e58c67c2d","sortOrder":2},"sortOrder":2,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"ac697758-1d55-421a-a83c-a253a1d1da11"}],"recentChangeFlags":null},{"id":"bffb576b-e61b-40e4-83cc-3fa89f8847f4","uri":"https://widget.thefork.com","name":"widget.thefork.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d28459d1-ed8f-496e-a407-622fb5b62d3d","sortOrder":3},"sortOrder":3,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"bffb576b-e61b-40e4-83cc-3fa89f8847f4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bffb576b-e61b-40e4-83cc-3fa89f8847f4"}],"recentChangeFlags":null},{"id":"d8dd0fbe-d8a6-49c7-864e-2a2b65705b8d","uri":"https://api.thefork.io","name":"api.thefork.io","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d950ac38-32b3-440f-8a6a-1f098cb97188","sortOrder":4},"sortOrder":4,"tags":[{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"d8dd0fbe-d8a6-49c7-864e-2a2b65705b8d"}],"recentChangeFlags":null},{"id":"f9fb0f07-9971-4df7-be6b-50a89b88dea9","uri":"https://secure.thefork.com","name":"secure.thefork.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f1f92f6b-e4d1-4476-a897-6a82e9bea010","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f9fb0f07-9971-4df7-be6b-50a89b88dea9"}],"recentChangeFlags":null},{"id":"dab2c44a-ea62-430a-b001-ff735e5b0599","uri":"https://payment.lafourchette.com","name":"payment.lafourchette.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"660bc7dd-060d-4ead-b22d-6e9dc9497742","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"dab2c44a-ea62-430a-b001-ff735e5b0599"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"f8059248-7943-4a0e-959e-1c0db89e08d1","p1MaxCents":350000,"p1MinCents":250000,"p2MaxCents":175000,"p2MinCents":150000,"p3MaxCents":70000,"p3MinCents":50000,"p4MaxCents":30000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eWebsite\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003emanager.thefork.com\u003c/code\u003e This is the B2B version of TheForks\u0026#39; Business to Business web application.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003eUSE ONLY TEST RESTAURANTS. It is imperative to understand that testing on live production restaurants or their systems is strictly prohibited without exception. Failure to adhere to this policy will not be tolerated and will result in program ban.\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\n\u003ch2\u003eAPI Testing\u003c/h2\u003e\n\n\u003cp\u003eThe API sitting behind the application is in scope, however, no documentation is available for it. Please test it from a black box perspective.\u003c/p\u003e\n\n\u003ch2\u003eNotes\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eJWT TTL is 5mins. For example: if you logout, your session is invalidated after 5mins. If you reset password, all sessions are disconnected after 5 minutes.\u003c/li\u003e\n\u003cli\u003eRedirection to an Out-of-Scope domain (*.theforkmanager.com) may occur. Although this may happen while authenticating, the below-listed scope is specific to this program and should be followed when testing \u0026amp; submitting reports.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":2500,"max":3500},"2":{"min":1500,"max":1750},"3":{"min":500,"max":700},"4":{"min":150,"max":300},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"85aea695-4514-4303-8aa3-f9853283cf57","name":"B2B Low reward","targets":[{"id":"31d2413d-65e1-4372-b427-6bc314bc9b45","uri":"https://www.theforkmanager.com","name":"TheFork Manager Blog","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"01bd6efd-a2f4-44ce-8128-2ee1e8f6a29b","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"ac85ca65-9c4a-4367-9484-e0374c347e59","p1MaxCents":100000,"p1MinCents":50000,"p2MaxCents":40000,"p2MinCents":20000,"p3MaxCents":20000,"p3MinCents":10000,"p4MaxCents":10000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":500,"max":1000},"2":{"min":200,"max":400},"3":{"min":100,"max":200},"4":{"min":50,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"0de02a02-0044-48dd-aafd-d8ad5feab625","name":"B2C","targets":[{"id":"8170c6da-dba5-4eea-b43f-94d046c9da7b","uri":null,"name":"https://www.thefork.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5d2fecdd-eb1c-4d79-9411-f1bb0c10b598","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"41f3ea76-6bb6-429a-92a2-8818ce15808a","uri":"https://apps.apple.com/app/thefork-restaurants-bookings/id424850908","name":"TheFork iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"360fd011-06dd-4ea1-9414-140f24c3c1f2","sortOrder":1},"sortOrder":1,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"41f3ea76-6bb6-429a-92a2-8818ce15808a"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"41f3ea76-6bb6-429a-92a2-8818ce15808a"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"41f3ea76-6bb6-429a-92a2-8818ce15808a"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"41f3ea76-6bb6-429a-92a2-8818ce15808a"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"41f3ea76-6bb6-429a-92a2-8818ce15808a"}],"recentChangeFlags":null},{"id":"053e8216-9a38-481f-8f30-d7b037940864","uri":"https://play.google.com/store/apps/details?id=com.lafourchette.lafourchette","name":"TheFork Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2576742d-c0d4-4bdd-951e-beda5657e08f","sortOrder":2},"sortOrder":2,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"053e8216-9a38-481f-8f30-d7b037940864"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"053e8216-9a38-481f-8f30-d7b037940864"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"053e8216-9a38-481f-8f30-d7b037940864"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"053e8216-9a38-481f-8f30-d7b037940864"}],"recentChangeFlags":null},{"id":"70b89707-ccc9-43b4-8ba6-1f92f47c4536","uri":"https://api.thefork.com","name":"https://api.thefork.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bd7be65e-e0ce-4dde-b562-b89f66908682","sortOrder":3},"sortOrder":3,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"70b89707-ccc9-43b4-8ba6-1f92f47c4536"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"70b89707-ccc9-43b4-8ba6-1f92f47c4536"}],"recentChangeFlags":null},{"id":"95057d5f-449e-4d84-93e6-f3d7da2270ee","uri":"https://api-ws.thefork.com","name":"https://api-ws.thefork.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5ca6184e-7c31-4a34-9325-5ad3a035fe69","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"95057d5f-449e-4d84-93e6-f3d7da2270ee"},{"id":"537a37bb-0fd5-4cb3-88b3-d08fac588565","name":"Websockets","targetId":"95057d5f-449e-4d84-93e6-f3d7da2270ee"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"95057d5f-449e-4d84-93e6-f3d7da2270ee"}],"recentChangeFlags":null},{"id":"8ee2109e-6998-43eb-8f9a-0d201e20c832","uri":"https://m.thefork.com","name":"https://m.thefork.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3fda3f56-ce6b-4690-9a68-2e55e41c4d79","sortOrder":5},"sortOrder":5,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"8ee2109e-6998-43eb-8f9a-0d201e20c832"},{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"8ee2109e-6998-43eb-8f9a-0d201e20c832"},{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"8ee2109e-6998-43eb-8f9a-0d201e20c832"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"8ee2109e-6998-43eb-8f9a-0d201e20c832"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"8ee2109e-6998-43eb-8f9a-0d201e20c832"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8ee2109e-6998-43eb-8f9a-0d201e20c832"}],"recentChangeFlags":null},{"id":"b426c269-8636-46b5-8074-9e048a21cf65","uri":"https://blog.thefork.com/","name":"https://blog.thefork.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c49c3354-47ef-44c2-bbc3-7735d8857727","sortOrder":6},"sortOrder":6,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"b426c269-8636-46b5-8074-9e048a21cf65"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"f8059248-7943-4a0e-959e-1c0db89e08d1","p1MaxCents":350000,"p1MinCents":250000,"p2MaxCents":175000,"p2MinCents":150000,"p3MaxCents":70000,"p3MinCents":50000,"p4MaxCents":30000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eWebsite\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ehttps://www.thefork.com\u003c/code\u003e - This is the B2C version of TheForks\u0026#39; Business to Consumer web application. Researchers are invited to test the full functionality of this application, both from the logged in and anonymous perspective.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eBooking Restaurants\u003c/h3\u003e\n\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003eIMPORTANT: When booking reservations, please ONLY USE THE TEST RESTAURANTS PROVIDED BELOW. It is imperative to understand that testing on live production restaurants or their systems is strictly prohibited without exception. Failure to adhere to this policy will not be tolerated and will result in program ban.\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://bugcrowd.com/engagements/thefork-mbb-og/attachments/528b7e12-7934-43ad-829f-d3ff10ae68b8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eList of 500 test restaurants\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.thefork.com/restaurant/the-spanish-white-hacker-r685267\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSpanish Restaurant\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.thefork.com/restaurant/the-italian-white-hacker-r685265\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eItalian Restaurant\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.thefork.com/restaurant/the-french-white-hacker-r717195\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFrench Restaurant\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eThese restaurants can\u0026#39;t be found through search field, please go directly through the link.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch3\u003ePayments\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eMake a reservation with your @bugcrowd.com or @bugcrowdninja.com account as close to the time of your test as possible.  Bookings can be made through the B2C website or mobile apps on one of the test restaurants.\u003c/li\u003e\n\u003cli\u003ePayment functionality in TFPay only opens for the specific booking once your dining time has started and stays open for a maximum of 3 hrs\u003c/li\u003e\n\u003cli\u003eTo be able to perform test payments, you must have logged in to the mobile app with an @bugcrowd.com or @bugcrowdninja.com email account\u003c/li\u003e\n\u003cli\u003eNavigate to TheFork pay section through the menu in the app, add a \u003ca href=\"https://bugcrowd.com/engagements/thefork-b2c-wng/attachments/56edf652-dceb-4043-a6a3-57d498db71af\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003etest credit card \u0026amp; gift cards\u003c/a\u003e or select the the relevant booking, then add your test credit card \u0026amp; gift cards\u003c/li\u003e\n\u003cli\u003eComplete the payment. Note a maximum of 2 payments per reservation is allowed.\u003c/li\u003e\n\u003cli\u003eNavigate to TheFork Pay section to verify the status of the payment\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAPI Documentation\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://api.thefork.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://api.thefork.com\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://google-reserve-api.thefork.io\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://google-reserve-api.thefork.io\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":2500,"max":3500},"2":{"min":1500,"max":1750},"3":{"min":500,"max":700},"4":{"min":150,"max":300},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"b50154a2-a68a-4ebb-8c82-3b75d14301d4","name":"B2C Low reward","targets":[{"id":"9fd1f006-6823-4e2a-a1cb-13317186f50a","uri":"https://*.tools.thefork.tech","name":"*.tools.thefork.tech","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8233a04f-3cf8-46f2-b75f-8737803f4bba","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9fd1f006-6823-4e2a-a1cb-13317186f50a"}],"recentChangeFlags":null},{"id":"102b93ac-3127-44e9-8ab6-d53be06f2816","uri":"https://www.restaurant-information.com","name":"www.restaurant-information.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a1e0d4db-8e57-4d06-b176-2b8c9eeeace5","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"102b93ac-3127-44e9-8ab6-d53be06f2816"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":{"id":"ac85ca65-9c4a-4367-9484-e0374c347e59","p1MaxCents":100000,"p1MinCents":50000,"p2MaxCents":40000,"p2MinCents":20000,"p3MaxCents":20000,"p3MinCents":10000,"p4MaxCents":10000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch1\u003eTools\u003c/h1\u003e\n\n\u003cp\u003eAll of our tools are under *.tools.thefork.tech, some of them are reachable only internally. \u003c/p\u003e","rewardRangeData":{"1":{"min":500,"max":1000},"2":{"min":200,"max":400},"3":{"min":100,"max":200},"4":{"min":50,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"9f67e790-909c-45c3-b26d-ae2e224ccbc6","name":"B2B Out of scope","targets":[{"id":"51892b41-d9da-4896-b275-0a69ba140bd9","uri":null,"name":"*.myfourchette.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"15ab0af9-1634-4925-bd94-f888592df257","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"51892b41-d9da-4896-b275-0a69ba140bd9"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"51892b41-d9da-4896-b275-0a69ba140bd9"}],"recentChangeFlags":null},{"id":"03863407-4696-4aad-9fd3-ebe17d7e0439","uri":null,"name":"www.myfourchette.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"38789bc9-e6c6-4665-a9dd-27c773d98d23","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"03863407-4696-4aad-9fd3-ebe17d7e0439"}],"recentChangeFlags":null},{"id":"d5a07f8e-8d9a-4614-9d76-4819c4c2ce0f","uri":null,"name":"website.theforkmanager.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f608e890-e584-4c85-878d-730641410b49","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"2bed8602-4fdf-4a29-abe8-3d9dc7194260","uri":null,"name":"*.lafourchette.rest ","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c34dcc6d-9bbe-4efa-96b3-256c06a0fd5a","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"edcd9268-8af3-4473-83e3-bf541295bc24","uri":null,"name":"login.theforkmanager.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f5a5164b-9980-4644-83c0-be6e63e0d4f7","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"a499166f-b970-4687-bbbb-6a42fafe245a","uri":"","name":"developer.thefork.io","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fe5f0c1e-dbb8-45eb-b27c-7f0d12c9d0fe","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":4,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"f1f835eb-86bc-4596-986e-53c6aaeebc00","name":"B2C Out of scope","targets":[{"id":"5c4007f3-95e6-419c-ab0f-477b377ca6b7","uri":"","name":"https://*.eltenedor.*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"db745e65-32f2-4eb0-a96f-419712ddb912","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5c4007f3-95e6-419c-ab0f-477b377ca6b7"}],"recentChangeFlags":null},{"id":"a3740b35-b45c-4ee5-9c9d-d3b39dbbceb3","uri":"","name":"https://www.thefork.*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7d00fdb4-837f-4b57-98f4-95aa930a8b71","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a3740b35-b45c-4ee5-9c9d-d3b39dbbceb3"}],"recentChangeFlags":null},{"id":"20423756-13c5-4c5f-9456-44ce8bab218a","uri":"","name":"module.thefork.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"65cd843b-cafc-4d41-9d9e-0b0d3f647170","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"20423756-13c5-4c5f-9456-44ce8bab218a"}],"recentChangeFlags":null},{"id":"57f198b6-36ca-4883-8ff1-0cbeeaf6d611","uri":"","name":"https://www.lafourchette.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4e7d2d40-a40d-4cbc-bb02-c3bd2125fe23","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"57f198b6-36ca-4883-8ff1-0cbeeaf6d611"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":5,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[{"id":"da2bf607-4338-4b67-bbdb-7343aaec0723","attachmentPath":"https://bugcrowd.com/engagements/thefork-mbb-og/attachments/da2bf607-4338-4b67-bbdb-7343aaec0723","name":"Bugcrowd_Payments_2023.pdf","filename":"Bugcrowd_Payments_2023.pdf","description":null,"icon":"fileOther","size":318456,"sizeLabel":"311 KB","uploadedAt":"25 Nov 2025","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/thefork-mbb-og/attachments/da2bf607-4338-4b67-bbdb-7343aaec0723"},{"id":"528b7e12-7934-43ad-829f-d3ff10ae68b8","attachmentPath":"https://bugcrowd.com/engagements/thefork-mbb-og/attachments/528b7e12-7934-43ad-829f-d3ff10ae68b8","name":"TheFork%20-%20Public%20Bugcrowd%20program%20-%20July%202026%20-%20manager.thefork.com.pdf","filename":"TheFork%20-%20Public%20Bugcrowd%20program%20-%20July%202026%20-%20manager.thefork.com.pdf","description":"Test Restaurant details:\n- B2C Restaurant booking URL\n- B2B TFM credentials","icon":"fileOther","size":259192,"sizeLabel":"253 KB","uploadedAt":"8 Jul 2026","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/thefork-mbb-og/attachments/528b7e12-7934-43ad-829f-d3ff10ae68b8"}],"engagement":{"id":"27f0fc18-3521-4376-9f35-846d667f8296","code":"thefork-mbb-og","state":"in_progress","endsAt":null,"bountyId":"f7ab98fd-8c9a-47ee-a65d-a1e2e47e7476","startsAt":"2025-12-09T15:42:23Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Hospitality","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/bd73/78c9/794397c7/40b0bb00ca1caa91bae8db93a6fce4ac_TheFork_Symbol_Mint_RGB3.png","logoBackgroundColor":"#8bff6e","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-12-09T15:42:23.304Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/thefork-mbb-og","changelogs":"/engagements/thefork-mbb-og/changelog","submissions":null,"announcements":"/engagements/thefork-mbb-og/announcements","hallOfFame":"/engagements/thefork-mbb-og/hall_of_fames","crowdstream":"/engagements/thefork-mbb-og/crowdstream"},"announcementsCount":3,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/thefork-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=thefork-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/thefork-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/thefork-mbb-og/changelog","publishedAt":"2026-07-08T11:51:29.717Z","engagementChangelogUrl":"/engagements/thefork-mbb-og/changelog/03044428-9524-46e6-8fb4-7b16a7a9032f","createUserFeedbacksUrl":"/engagements/thefork-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/thefork-mbb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}