{"id":"a2833331-ef57-43c0-8b42-70713ea035d2","engagementId":"1575446b-3cdd-4b88-a898-93d40eb005a0","data":{"brief":{"id":"cf78ba2f-4af7-4296-8aec-8e339654e9ee","name":"20 Minuten","tagline":"20 Minuten Bug Bounty Program","description":"\u003cp\u003eLaunched in 1999, 20 Minuten is the number one daily commuter newspaper for Switzerland. It provokes discussion with its news on politics, business, sport, entertainment and services.\u003c/p\u003e\n\n\u003cp\u003eSecurity is a top priority for us and that is why we are running a public Bug Bounty program for our 20 Minuten website (\u003ca href=\"https://www.20min.ch\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.20min.ch\u003c/a\u003e). We want to ensure our newspaper can stand up to the best hackers in the world from day 0!\u003cbr\u003e\nThis website is always in development and subject to continuous updates and new features. Other 20 Minuten websites, including legacy sites, are not part of this program, so please focus your efforts on www.20min.ch. Checkout the Target Groups for more information and good luck!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as In-Scope. \u003cem\u003eAny domain/property of 20 Minuten not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e If you believe you've identified a vulnerability on a system outside the scope, please reach out to support@bugcrowd.com before submitting.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess / Credentials\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe target URLs are publicly available\u003c/li\u003e\n\u003cli\u003eFor some testing a login might be required for the main site. Where a simple (free) registration is offered, please use your @bugcrowdninja.com email address. Please note that the login itself is out of scope.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eEnvironment\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe target environment is production, running on AWS (Kubernetes, Node/JS, Go)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eNo rate-limiting or (D)DoS attack related submissions\u003c/li\u003e\n\u003cli\u003eNo aggressive automated scans as these will most likely lock you out (by AWS)\u003c/li\u003e\n\u003cli\u003eNo automated scan reports without valid proof of concept\u003c/li\u003e\n\u003cli\u003eLogin and session management related to our Open ID provider, including\n\n\u003cul\u003e\n\u003cli\u003euser registration, login, logout and password reset\u003c/li\u003e\n\u003cli\u003ehttps://tgt.tamedia.ch\u003c/li\u003e\n\u003cli\u003ehttps://auth.20min.ch\u003c/li\u003e\n\u003cli\u003ehttps://cre-api.tamedia.ch\u003c/li\u003e\n\u003cli\u003ehttps://track.tagesanzeiger.ch\u003c/li\u003e\n\u003cli\u003ehttps://*.connect.ringier.ch\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eSubdomains not specifically listed in scope\u003c/li\u003e\n\u003cli\u003eiOS and Android apps\u003c/li\u003e\n\u003cli\u003eSubdomain takeovers\u003c/li\u003e\n\u003cli\u003eDMARC, DKIM and SPF\u003c/li\u003e\n\u003cli\u003eWe won't accept broken or nonexistent social media links like Twitter, Facebook, Instagram.\u003c/li\u003e\n\u003cli\u003eManipulation of polls, likes on comments and content ratings, and comment abuse reports / escalations. They are considered as accepted risk.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"1af9ec2a-b131-44d8-8b6f-45f282a8d24f","name":"In scope targets","targets":[{"id":"ab20c3e6-0b10-47c7-b209-5fd6cac878c1","uri":"https://www.20min.ch","name":"https://www.20min.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3b1b4958-d1a7-457f-8f7a-a4f92268731f","sortOrder":0},"sortOrder":0,"tags":[{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"ab20c3e6-0b10-47c7-b209-5fd6cac878c1"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"ab20c3e6-0b10-47c7-b209-5fd6cac878c1"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"ab20c3e6-0b10-47c7-b209-5fd6cac878c1"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"ab20c3e6-0b10-47c7-b209-5fd6cac878c1"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"ab20c3e6-0b10-47c7-b209-5fd6cac878c1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ab20c3e6-0b10-47c7-b209-5fd6cac878c1"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"ab20c3e6-0b10-47c7-b209-5fd6cac878c1"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"ab20c3e6-0b10-47c7-b209-5fd6cac878c1"}],"recentChangeFlags":null},{"id":"ec40c4c4-26e3-4558-930f-f3212e940169","uri":"https://coral.20min.ch/","name":"https://cm.20min.ch/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8325e364-8512-4d95-88b1-15f5a500e8a5","sortOrder":0},"sortOrder":0,"tags":[{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"ec40c4c4-26e3-4558-930f-f3212e940169"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"ec40c4c4-26e3-4558-930f-f3212e940169"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ec40c4c4-26e3-4558-930f-f3212e940169"}],"recentChangeFlags":null},{"id":"3ecc03d3-2d11-456e-a844-4fa66b098df1","uri":"https://api.20min.ch/","name":"https://api.20min.ch/","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4dea5ef1-71d3-41be-a576-d3e983f8f4ff","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"3ecc03d3-2d11-456e-a844-4fa66b098df1"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"3ecc03d3-2d11-456e-a844-4fa66b098df1"}],"recentChangeFlags":null},{"id":"5add7e86-3502-4cd5-81f4-9c2402a2807a","uri":"https://videoplayer.20min.ch","name":"https://videoplayer.20min.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f7b32b57-5d5c-4aec-abc9-ddf35f96860d","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"5add7e86-3502-4cd5-81f4-9c2402a2807a"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"5add7e86-3502-4cd5-81f4-9c2402a2807a"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"5add7e86-3502-4cd5-81f4-9c2402a2807a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5add7e86-3502-4cd5-81f4-9c2402a2807a"}],"recentChangeFlags":null},{"id":"de78ac23-3b1a-485c-8600-0bd37096d976","uri":"https://partner-feeds.20min.ch","name":"https://partner-feeds.20min.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e7d41b6e-b7dc-404b-9a9e-46063f8f948f","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"de78ac23-3b1a-485c-8600-0bd37096d976"}],"recentChangeFlags":null},{"id":"ec96dd8d-869e-4da5-a207-524da4468516","uri":"https://screenplayer.20min.ch","name":"https://screenplayer.20min.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"52becfb6-f76e-40e0-b558-7fa858eaa229","sortOrder":0},"sortOrder":0,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"ec96dd8d-869e-4da5-a207-524da4468516"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ec96dd8d-869e-4da5-a207-524da4468516"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"ec96dd8d-869e-4da5-a207-524da4468516"}],"recentChangeFlags":null},{"id":"4d7c197f-8d6f-4a28-9534-75edd8329c3a","uri":"https://audio.20min.ch/","name":"https://audio.20min.ch","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0ec5f1f0-7930-4ccd-87b6-2ba75e37a026","sortOrder":6},"sortOrder":6,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"4d7c197f-8d6f-4a28-9534-75edd8329c3a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4d7c197f-8d6f-4a28-9534-75edd8329c3a"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"bd52ee73-49d5-4130-a7f9-e3db0fdb507c","p1MaxCents":500000,"p1MinCents":400000,"p2MaxCents":240000,"p2MinCents":200000,"p3MaxCents":90000,"p3MinCents":60000,"p4MaxCents":30000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":4000,"max":5000},"2":{"min":2000,"max":2400},"3":{"min":600,"max":900},"4":{"min":250,"max":300},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"f8af7f32-ec9e-4ded-9c92-76bf5c4bc8b6","name":"Out of scope targets","targets":[{"id":"8e596d24-199d-4723-b588-3c8820137163","uri":null,"name":"https://tgt.tamedia.ch","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e36ada96-6ffc-4653-acf8-3430db62e05d","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"33a0c66b-0777-4176-85fb-abd56184fd8b","uri":null,"name":"http://auth.20min.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4d4be398-fcd6-4931-91f2-b8fe6eb5fea1","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"4fbe7552-a0c4-45e8-9084-e87602da5738","uri":null,"name":"https://cre-api.tamedia.ch","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c10f96dd-9149-47e9-b178-70f9c899d028","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a8783f0c-2b3d-4e0c-a565-eea957a6bc4f","uri":null,"name":"https://track.20min.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"95ab0bb8-2506-4f25-ae0c-3148815af45a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"80316659-a35f-410a-911d-93aaccf8c239","uri":"","name":"Social Media Links (older than 2 years)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e21ed0b1-650a-462a-aef3-24a515d5894d","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e114c142-c956-4a45-8e45-d0fcdd5bf897","uri":"","name":"Subdomain Takeover ","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7f0fce97-7fb3-4124-95be-605bcb4243db","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"40de5642-5cf5-440b-a822-d8cf7ce7e315","uri":"","name":"DMARC, SPF, DKIM","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"69e7e729-ddd3-4692-84c0-2e5793069a6a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"13acd66e-291d-46a8-aa74-618f838f94ba","uri":"","name":"https://*.connect.ringier.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8124df38-3b09-4511-8e37-5478b102e479","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"813e10b9-ff36-4634-b97c-fbc8c932bbb8","uri":"","name":"*.onelog.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fae72fd0-0e26-4426-82cb-20389298e62f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"f41e9eb2-b70e-4435-b6c4-a50e37892e11","uri":"","name":"*.20min-tv.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e60cc563-0ec0-461a-ac0a-7b996b1510b3","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"9aeae030-ff89-446d-80b2-a3442e1e61df","uri":"","name":"*.newsnetz.tv","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0b91cafc-44e6-417d-9c22-1eb6f647ac2f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"b03a4cf6-4f49-46a7-b0a0-eb6b203ecc46","uri":"","name":"*.appuser.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a56de0fa-8f43-42bc-b793-038538d1e960","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"353c7c61-4240-49d1-b652-f105618bb8d1","uri":"","name":"*.iagentur.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"557fe1c4-963a-4951-b20e-72b348c2c7c2","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"fbc3b10e-2f88-4593-b8a3-fb4477bf4c67","uri":"","name":"*.streamboat.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2038fba9-3749-440d-93f0-aa02a77af0d5","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"486a60c1-81d9-4e10-9aee-79d402de8e89","uri":"","name":"*.streamboatserver.ch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e4bb57ee-16e9-4e65-8bea-8ba17c95bd83","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"607e336f-a92b-4c8e-83d5-09b166c9a0b5","uri":"","name":"Other Domains and Subdomains not specifically in scope","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2f41eba7-a3bc-4dbc-b6b5-51ceadee2229","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"1575446b-3cdd-4b88-a898-93d40eb005a0","code":"twentyminuten","state":"in_progress","endsAt":null,"bountyId":"eb379bfd-b658-4851-9be6-8f835d1e2af8","startsAt":"2020-01-28T19:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/9b28/bc5d/c9b6e5c5/263ca267f5529f9c73b6b45304b6e5e3_20minuten.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-01-28T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/twentyminuten","changelogs":"/engagements/twentyminuten/changelog","submissions":null,"announcements":"/engagements/twentyminuten/announcements","hallOfFame":"/engagements/twentyminuten/hall_of_fames","crowdstream":"/engagements/twentyminuten/crowdstream"},"announcementsCount":9,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/twentyminuten/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=twentyminuten\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/twentyminuten/engagement_subscribers","engagementChangelogsUrl":"/engagements/twentyminuten/changelog","publishedAt":"2026-08-28T14:33:24.441Z","engagementChangelogUrl":"/engagements/twentyminuten/changelog/a2833331-ef57-43c0-8b42-70713ea035d2","createUserFeedbacksUrl":"/engagements/twentyminuten/feedbacks","engagementCrowdstreamUrl":"/engagements/twentyminuten/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}