{"id":"dc419cd1-6ab0-4cbe-9877-a3cc794f72f3","engagementId":"dece68e5-c769-4f73-a3bd-d627bf298829","data":{"brief":{"id":"3bdb81d1-597e-44c5-8f7e-1f830484a4fe","name":"Under Armour Product Security","tagline":"Under Armour’s vision is to inspire you with performance solutions you never knew you needed and can’t imagine living without.","description":"\u003ch2\u003eOur Mission\u003c/h2\u003e\n\n\u003ch4\u003eTO MAKE ALL ATHLETES BETTER THROUGH PASSION, DESIGN AND THE RELENTLESS PURSUIT OF INNOVATION.\u003c/h4\u003e\n\n\u003cp\u003eOur Brand is about energy and passion. It’s about an obsession with \u003cstrong\u003eFighting On Together\u003c/strong\u003e to be stronger and more powerful - to \u003cstrong\u003eAlways Connect\u003c/strong\u003e. We believe in \u003cstrong\u003eThinking Beyond\u003c/strong\u003e to invent, innovate, and \u003cstrong\u003eCreate Fearlessly\u003c/strong\u003e. We believe in staying connected \u003cstrong\u003eTo Athletes\u003c/strong\u003e and know that adversity \u003cem\u003eeven in the digital world\u003c/em\u003e can bring us together. We know that the world expects great things from Under Armour and that daring to lead means thinking beyond. Our Brand Voice has always been simple and bold, as illustrated in our earliest commercial spot from 2003, rallying an entire generation of athletes to \u003cstrong\u003e\u003cem\u003ePROTECT THIS HOUSE\u003c/em\u003e\u003c/strong\u003e.\u003c/p\u003e\n\n\u003cp\u003eUnder Armour \u003ca href=\"https://careers.underarmour.com/mission-values\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eMission \u0026amp; Values\u003c/a\u003e\u003c/p\u003e\n\n\u003cp\u003eWe want to engage the security research community as partners \u0026amp; teammates to \u003cstrong\u003eStay True\u003c/strong\u003e, protect our athletes, and protect their data. Doing so enables our \u003cstrong\u003eGlobal Community\u003c/strong\u003e of athletes to \u003cstrong\u003eCelebrate their Goals\u003c/strong\u003e.\u003c/p\u003e\n\n\u003ch4\u003eThere are no odds too big. No goal too high. Will you \u003cstrong\u003e\u003cem\u003ePROTECT THIS HOUSE\u003c/em\u003e\u003c/strong\u003e?\u003c/h4\u003e\n\n\u003ch4\u003e#WEWILL #WillFindsAWay\u003c/h4\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eUnder Armour VRT Amendments\u003c/h2\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eBug Type\u003c/th\u003e\n\u003cth\u003eOriginal Priority Rating\u003c/th\u003e\n\u003cth\u003eUnder Armour Priority Rating\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eInjection File – Inclusion – Local\u003c/td\u003e\n\u003ctd\u003eP1\u003c/td\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eInjection – XML External Entity Injection (XXE)\u003c/td\u003e\n\u003ctd\u003eP1\u003c/td\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eCross-Site Scripting (XSS) – Stored\u003c/td\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration Misconfigured – DNS - With POC (High Impact Subdomain Takeover)\u003c/td\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration Misconfigured – DNS - With POC (Basic Subdomain Takeover)\u003c/td\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSensitive Misconfiguration – Weak Password Policy – Complexity, Both Length and Char Type Not Enforced\u003c/td\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration – Lack of Password Confirmation - Change Email Address\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration – Lack of Password Confirmation - Change Password\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration – Lack of Password Confirmation - Delete Account\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration – Unsafe File Upload – No Antivirus\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration – Unsafe File Upload – No Size Limit\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration – Weak Password Policy – Complexity, Length Not Enforced\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration – Weak Password Policy – Complexity, Char Type Not Enforced\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration – Weak Reset Password Policy – Token is Not Invalidated After Use\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSecurity Misconfiguration – Captcha Bypass – Implementation Vulnerability\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSensitive Data Exposure – EXIF Geolocation Data Not Stripped From Uploaded Images – Automatic User Enumeration\u003c/td\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSensitive Data Exposure – EXIF Geolocation Data Not Stripped From Uploaded Images – Manual User Enumeration\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eMissing Function Level Access Control – Username Enumeration – Data Leak\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSensitive Data Exposure – Private API Keys  – No POC\u003c/td\u003e\n\u003ctd\u003eP1\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eApplication - Level Denial-of-Service (DoS) – Low Impact and/or Medium Difficulty – Password Length DoS (Server-Side)\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBroken Access Control (BAC) - Username/Email Enumeration - Non-Brute Force\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSensitive Data Exposure - Visible Detailed Error/Debug Page - Detailed Server Configuration\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Under Armour not listed in the targets section is out of scope. This includes any/all subdomains not listed above. All official Under Armour social media accounts (e.g., Meta, Instagram, Twitter, LinkedIn, TikTok, YouTube).\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess \u0026amp; Credentials\u003c/h2\u003e\n\n\u003cp\u003eResearchers must sign up for test accounts using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. \u003c/p\u003e\n\n\u003cp\u003eIf additional accounts are necessary, self-signup using the pattern:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eBugcrowd_Username_2@bugcrowdninja.com\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cp\u003eOur primary focus is our athletes and their data. As such, \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eIntegrity \u0026amp; accuracy of user data\u003c/li\u003e\n\u003cli\u003eAvailability of user data for each user and for those they have chosen to share with\u003c/li\u003e\n\u003cli\u003eConfidentiality of user data, and reflecting their privacy choices for that data. For example If a user sets a workout as public, all other users may see it. If they set to share with friends, non-friends should not see it. And if they mark as private, even their friends should not see it.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eMissing or incorrect SPF records of any kind\u003c/li\u003e\n\u003cli\u003eMissing or incorrect DMARC records of any kind\u003c/li\u003e\n\u003cli\u003eDenial of Service (DoS) and Distributed Denial of Service (DDoS)\u003c/li\u003e\n\u003cli\u003eAttacking other users's accounts or devices\u003c/li\u003e\n\u003cli\u003eCollecting \u0026amp; retaining user data extracted from the platform\u003c/li\u003e\n\u003cli\u003eAttacking advertisers or digital advertising exchanges we partner with\u003c/li\u003e\n\u003cli\u003eAttacking Under Armour advertisements on any website\u003c/li\u003e\n\u003cli\u003eDistributing malware, ransomware, viruses, or worms on any UnderArmour or affiliated website\u003c/li\u003e\n\u003cli\u003eTargeting administrative portals\u003c/li\u003e\n\u003cli\u003eInfrastructure attacks on our cloud-based servers and the supporting providers\u003c/li\u003e\n\u003cli\u003eBrute force on login or forgot password page and account lockout\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cblockquote\u003e\n\u003cp\u003eNote: If you encounter user data leaks while testing, we want to know, and will absolutely reward those defects. But once reported, we expect researchers to securely delete any data obtained in the process of testing \u0026amp; reporting those defects. However, while credentials found on the dark web or credential harvesting platforms should be reported, they will be treated as P5s as Under Armour has systems in place to scan for these.\u003c/p\u003e\n\u003c/blockquote\u003e\n\n\u003ch2\u003eOut of Scope Bugs for \u003cstrong\u003eAndroid\u003c/strong\u003e Apps\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eShared links leaked through the system clipboard.\u003c/li\u003e\n\u003cli\u003eAny URIs leaked because a malicious app has permission to view URIs opened\u003c/li\u003e\n\u003cli\u003eAbsence of certificate pinning \u003c/li\u003e\n\u003cli\u003eSensitive data in URLs/request bodies when protected by TLS\u003c/li\u003e\n\u003cli\u003eUser data stored unencrypted on external storage \u003c/li\u003e\n\u003cli\u003eLack of obfuscation is out of scope\u003c/li\u003e\n\u003cli\u003eOAuth \"app secret\" hard-coded/recoverable in apk \u003c/li\u003e\n\u003cli\u003eCrashes due to malformed Intents sent to exported Activity/Service/BroadcastReceive (exploiting these for sensitive data leakage is commonly in scope)\u003c/li\u003e\n\u003cli\u003eAny kind of sensitive data stored in app private directory \u003c/li\u003e\n\u003cli\u003eLack of binary protection control in android app\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of Scope Bugs for \u003cstrong\u003eiOS\u003c/strong\u003e Apps\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eLack of Exploit mitigations ie PIE, ARC, or Stack Canaries\u003c/li\u003e\n\u003cli\u003eAbsence of certificate pinning \u003c/li\u003e\n\u003cli\u003ePath disclosure in the binary\u003c/li\u003e\n\u003cli\u003eUser data stored unencrypted on the file system\u003c/li\u003e\n\u003cli\u003eLack of obfuscation is out of scope\u003c/li\u003e\n\u003cli\u003eLack of jailbreak detection is out of scope\u003c/li\u003e\n\u003cli\u003eOAuth \"app secret\" hard-coded/recoverable in apk \u003c/li\u003e\n\u003cli\u003eCrashes due to malformed URL Schemes\u003c/li\u003e\n\u003cli\u003eLack of binary protection (anti-debugging) controls\u003c/li\u003e\n\u003cli\u003eSnapshot/Pasteboard leakage\u003c/li\u003e\n\u003cli\u003eRuntime hacking exploits (exploits only possible in a jailbroken environment) \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eBlackout Periods\u003c/h2\u003e\n\n\u003cp\u003eDue to athlete \u0026amp; business needs, certain dates will be off-limits for active security testing. This list will be updated regularly, so please check before engaging in active testing:\u003c/p\u003e\n\n\u003ch3\u003eNov 20 to Dec 3\u003c/h3\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eNotwithstanding the program safe harbor, you are expected, as always, to comply with all applicable laws. Ulta reserves all of legal rights in the event of noncompliance.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"3e28ba28-e539-4ed6-95ec-42cac103599a","name":"Paid Targets ","targets":[{"id":"1f3a85ed-04c1-4463-8dab-d8033d5604f9","uri":"https://www.underarmour.com","name":"www.underarmour.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7acca0f1-4ea8-418a-9f83-52c6df36cee9","sortOrder":0},"sortOrder":0,"tags":[{"id":"3585ef4a-cd09-429b-ad25-5777064e59c5","name":"Moment.js","targetId":"1f3a85ed-04c1-4463-8dab-d8033d5604f9"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"1f3a85ed-04c1-4463-8dab-d8033d5604f9"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"1f3a85ed-04c1-4463-8dab-d8033d5604f9"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"1f3a85ed-04c1-4463-8dab-d8033d5604f9"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1f3a85ed-04c1-4463-8dab-d8033d5604f9"},{"id":"c3412833-26e7-4bbd-907f-760d9da61232","name":"Newrelic","targetId":"1f3a85ed-04c1-4463-8dab-d8033d5604f9"}],"recentChangeFlags":null},{"id":"cb83af30-36a5-437d-a12e-130547ef097f","uri":"https://www.underarmour.co.uk","name":"www.underarmour.co.uk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b777afaa-30be-433d-8f7f-b4b61bb441ed","sortOrder":1},"sortOrder":1,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"cb83af30-36a5-437d-a12e-130547ef097f"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"cb83af30-36a5-437d-a12e-130547ef097f"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"cb83af30-36a5-437d-a12e-130547ef097f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cb83af30-36a5-437d-a12e-130547ef097f"}],"recentChangeFlags":null},{"id":"04654456-1760-4448-824c-5a5121ffda51","uri":"https://apps.apple.com/us/app/under-armour/id1092704571","name":"UA Shop iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9b16422a-b981-47a2-9c0a-009e2080f937","sortOrder":2},"sortOrder":2,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"04654456-1760-4448-824c-5a5121ffda51"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"04654456-1760-4448-824c-5a5121ffda51"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"04654456-1760-4448-824c-5a5121ffda51"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"04654456-1760-4448-824c-5a5121ffda51"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"04654456-1760-4448-824c-5a5121ffda51"}],"recentChangeFlags":null},{"id":"5e6a283a-634d-48f2-afe0-816ff4dd0aa0","uri":"https://play.google.com/store/apps/details?id=com.ua.shop\u0026hl=en","name":"UA Shop Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7665e752-7904-4d2f-8a95-cfe90eee69c9","sortOrder":3},"sortOrder":3,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"5e6a283a-634d-48f2-afe0-816ff4dd0aa0"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"5e6a283a-634d-48f2-afe0-816ff4dd0aa0"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"5e6a283a-634d-48f2-afe0-816ff4dd0aa0"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"5e6a283a-634d-48f2-afe0-816ff4dd0aa0"}],"recentChangeFlags":null},{"id":"19d41ed5-9224-4caf-8e88-4c5e24e24827","uri":"https://api.shop.ua.com/graphql","name":"https://api.shop.ua.com/graphql","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3ae68243-0475-4828-917a-d7c50d44ef19","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"19d41ed5-9224-4caf-8e88-4c5e24e24827"}],"recentChangeFlags":null},{"id":"dee1a548-e8ea-49bc-86bd-62dc5c67180f","uri":"https://www.underarmournext.co.uk/","name":"https://www.underarmournext.co.uk/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0e583964-3255-4366-ba4d-50d1c29bb2f1","sortOrder":5},"sortOrder":5,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"dee1a548-e8ea-49bc-86bd-62dc5c67180f"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"dee1a548-e8ea-49bc-86bd-62dc5c67180f"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"dee1a548-e8ea-49bc-86bd-62dc5c67180f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"dee1a548-e8ea-49bc-86bd-62dc5c67180f"}],"recentChangeFlags":null},{"id":"e72c2053-98f8-4eab-ae17-5bb6c5c0b765","uri":"https://underarmournext.com/","name":"https://underarmournext.com/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"744392d7-91c1-4c07-bf2f-c13d228baf36","sortOrder":6},"sortOrder":6,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"e72c2053-98f8-4eab-ae17-5bb6c5c0b765"},{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"e72c2053-98f8-4eab-ae17-5bb6c5c0b765"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"e72c2053-98f8-4eab-ae17-5bb6c5c0b765"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e72c2053-98f8-4eab-ae17-5bb6c5c0b765"}],"recentChangeFlags":null},{"id":"8247ab35-551d-4550-82c4-4665d70675a1","uri":"https://*.api.ua.com/","name":"*.api.ua.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9f8cf9bb-2d58-400a-8bc9-23ff64154818","sortOrder":7},"sortOrder":7,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"8247ab35-551d-4550-82c4-4665d70675a1"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"8247ab35-551d-4550-82c4-4665d70675a1"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"8247ab35-551d-4550-82c4-4665d70675a1"}],"recentChangeFlags":null},{"id":"c63031e7-d57d-4479-a089-d7a8789dee80","uri":"https://consumer-sustainability.underarmour.com/en","name":"https://consumer-sustainability.underarmour.com/en","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a63e31f0-08b2-45aa-b550-bfa908469be5","sortOrder":8},"sortOrder":8,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"c63031e7-d57d-4479-a089-d7a8789dee80"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"c63031e7-d57d-4479-a089-d7a8789dee80"}],"recentChangeFlags":null},{"id":"57d216dd-01c5-4f91-b2a1-960f4297189e","uri":"https://vpe-us.underarmour.com/","name":"vpe-us.underarmour.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"13d112b1-468f-416d-9b02-e73971a8130f","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"57d216dd-01c5-4f91-b2a1-960f4297189e"}],"recentChangeFlags":null},{"id":"326355cc-f7a1-419e-b3cc-d489af4459ce","uri":"https://www.underarmour.cn","name":"*.underarmour.cn","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cc8a6d68-3c63-4ff0-9c2d-548e77bcc0f0","sortOrder":10},"sortOrder":10,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"326355cc-f7a1-419e-b3cc-d489af4459ce"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"326355cc-f7a1-419e-b3cc-d489af4459ce"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"326355cc-f7a1-419e-b3cc-d489af4459ce"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"326355cc-f7a1-419e-b3cc-d489af4459ce"}],"recentChangeFlags":null},{"id":"177c8a1e-79c2-4215-a494-30c3022899d0","uri":"http://www.underarmour.com.sg","name":"www.underarmour.com.sg","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7146f5fb-6378-413b-a32d-9c723d731f72","sortOrder":11},"sortOrder":11,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"177c8a1e-79c2-4215-a494-30c3022899d0"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"177c8a1e-79c2-4215-a494-30c3022899d0"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"177c8a1e-79c2-4215-a494-30c3022899d0"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"177c8a1e-79c2-4215-a494-30c3022899d0"}],"recentChangeFlags":null},{"id":"4142c7ff-cf2d-4134-93cd-1edf6e3e7e2a","uri":"https://underarmour.co.kr","name":"underarmour.co.kr","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"288bb7c5-72bb-49f7-856b-9da267fecb9d","sortOrder":12},"sortOrder":12,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"4142c7ff-cf2d-4134-93cd-1edf6e3e7e2a"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"4142c7ff-cf2d-4134-93cd-1edf6e3e7e2a"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"4142c7ff-cf2d-4134-93cd-1edf6e3e7e2a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4142c7ff-cf2d-4134-93cd-1edf6e3e7e2a"}],"recentChangeFlags":null},{"id":"782146d9-93eb-4613-b27e-79ff2d4ac2e5","uri":"https://armourhouse.underarmour.com","name":"https://armourhouse.underarmour.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"77703c72-8581-4bd9-bef7-6b5c5777d3b3","sortOrder":13},"sortOrder":13,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"782146d9-93eb-4613-b27e-79ff2d4ac2e5"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"782146d9-93eb-4613-b27e-79ff2d4ac2e5"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"782146d9-93eb-4613-b27e-79ff2d4ac2e5"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"6c3172f3-aed6-4fd4-9165-f80c36032102","p1MaxCents":250000,"p1MinCents":120000,"p2MaxCents":120000,"p2MinCents":100000,"p3MaxCents":60000,"p3MinCents":40000,"p4MaxCents":12500,"p4MinCents":12500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eAPIs\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e  api.shop.ua.com/graphql \u003c/li\u003e\n\u003cli\u003eDeveloper API portal \u0026amp; documentation: \u003ca href=\"https://developer.underarmour.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edeveloper.underarmour.com\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eNote that the API domains are typically used within the context of applications that use them. Going directly to the domain will not provide any usable content. \u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":1200,"max":2500},"2":{"min":1000,"max":1200},"3":{"min":400,"max":600},"4":{"min":125,"max":125},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"2ed73582-e739-438a-9560-418eb4e6f5b1","name":"Out of Scope","targets":[{"id":"7f5edf16-dcb2-4a5e-85e9-654e3fb9be5e","uri":"","name":"www.underarmour.com/en-us/affiliate-home","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d1f0de19-cf4c-454e-8a90-d3fb5ee7dbfb","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"502d6b43-d4ec-4c2e-b1eb-54e94305284e","uri":"","name":" www.uabiz.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"68b8493f-8fd3-49e3-bd19-7154516a255d","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"b96a1b0f-5e36-4722-a957-9aa41b3450f3","uri":"","name":"investor.underarmour.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bc6259e4-2bdf-4e5a-8af5-21fec23a4eab","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"e53cc6ba-c180-41e4-8d38-0c2f2b3a8335","uri":"","name":"productsafety.underarmour.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"37d97fe2-d133-4f84-9807-5176da51e02f","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"21e84043-d5e8-4082-b9aa-bcae726da30d","uri":"","name":"uabusiness.force.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4b8ebaa2-42f8-4732-9b83-60e54cfeefc9","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"eeb53e91-7086-4e70-b048-f2eb63120c0d","uri":"","name":"www.underarmour.jobs","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d283461a-c9cb-45f9-942d-75f134e261c1","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"89c9c51d-554a-4bbc-b743-f0510e0fab3e","uri":"","name":"blog.underarmour.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"318aab40-ec9a-40ba-beef-532db63e8dcc","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null},{"id":"e96110d5-ba80-4a29-9e52-c29a7475abc4","uri":"","name":"www.uateamcatalogs.com ","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5298357e-5dfe-4709-8e2e-55991a3bc71e","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null},{"id":"b67fdf97-cc1c-4137-a1aa-633a757f28a3","uri":"","name":"www.uaretail.com ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"219518c5-49aa-464b-b230-23614c4866a4","sortOrder":9},"sortOrder":9,"tags":null,"recentChangeFlags":null},{"id":"95a2783f-9dac-4e0b-a40f-4c5e14627550","uri":"","name":"www.plankindustries.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6ff08a10-50a0-4e50-a65b-20e50b8b18b5","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"dece68e5-c769-4f73-a3bd-d627bf298829","code":"underarmour","state":"in_progress","endsAt":null,"bountyId":"33f31acf-68bf-4c3f-a5f2-a3c1d94020c1","startsAt":"2016-09-08T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/53a6/d83f/42edad25/c2980dc46e95f8cd4d876f8e59ef243e_Untitled111.jpg","logoBackgroundColor":"#000000","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2016-09-08T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/underarmour","changelogs":"/engagements/underarmour/changelog","submissions":null,"announcements":"/engagements/underarmour/announcements","hallOfFame":"/engagements/underarmour/hall_of_fames","crowdstream":null},"announcementsCount":21,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/underarmour/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=underarmour\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/underarmour/engagement_subscribers","engagementChangelogsUrl":"/engagements/underarmour/changelog","publishedAt":"2025-12-01T17:11:34.405Z","engagementChangelogUrl":"/engagements/underarmour/changelog/dc419cd1-6ab0-4cbe-9877-a3cc794f72f3","createUserFeedbacksUrl":"/engagements/underarmour/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}