{"id":"60d02fdf-24a4-47b6-a6ce-e34803cfbfee","engagementId":"d11e70bd-c81d-4649-9d45-a75e71aae058","data":{"brief":{"id":"d166eded-4658-433d-800f-9a03e023501e","name":"University of Canterbury Vulnerability Disclosure Engagement","tagline":"University of Canterbury Vulnerability Disclosure","description":"\u003cp\u003eWe are committed to protecting the security and privacy of our students, staff, and community. We believe that collaboration with the security research community is essential to maintaining the integrity of our information and digital platforms.\u003c/p\u003e\n\n\u003cp\u003eOur Vulnerability Disclosure Program is designed for security researchers to responsibly identify, and report vulnerabilities found in our public-facing digital assets. We appreciate your efforts and will work with you to validate and remediate reported issues in a timely manner.\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"f2d64fa8-5daf-49ef-8de8-edc7da2dfb4a","targetsOverview":"\u003ch2\u003ePartial Safe Harbor commitment\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"836b03b1-c18e-4b77-8420-800a53dd23cb","name":"In Scope","targets":[{"id":"a1f8d808-5bd6-42e9-a28b-aa0b043e4887","uri":"http://canterbury.ac.nz/","name":"*.canterbury.ac.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"74912858-3bc3-4d8a-bd6e-25b8608be883","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"d76289ad-8ee9-4f3a-b1af-1c498182b245","uri":"http://uconline.ac.nz/","name":"uconline.ac.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9a0ebc43-e607-4946-b144-2398d3921cf4","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"a22413f5-84bc-45ef-9592-9ad075062d14","uri":"http://koawa.co.nz/","name":"koawa.co.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"58bbbb9d-913a-4e3d-9d0c-addd257739db","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"6b7062ce-fa7f-4f47-83b6-27ba133d149f","uri":"http://hitlabnz.org/","name":"hitlabnz.org","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"49c620ba-41aa-4914-a6c9-eb44b4c2157a","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"0cb0e85c-8ae2-4a93-8e83-a4a0a4c46e65","uri":"http://ucsa.org.nz/","name":"ucsa.org.nz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ce2a2b74-13d7-4208-a045-19272afe8c61","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eAll public-facing domains owned or operated by us, including subdomains.\u003c/p\u003e\n\n\u003cp\u003eExamples include (but are not limited to):\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ehttps://learn.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003ehttps://uofcanterbury.folio.ebsco.com/\u003c/li\u003e\n\u003cli\u003ehttps://assura.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003ehttps://play.google.com/store/apps/details?id=nz.ac.canterbury.ucstudentmobile\u0026amp;hl=en-NZ\u003c/li\u003e\n\u003cli\u003ehttps://go.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003ehttps://profiles.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003ehttps://elements.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003ehttps://rpms.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003ehttps://www.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003ehttps://myuc.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003ehttps://ouruc.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003ehttps://connectuc.canterbury.ac.nz/\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ehttps://uconline.ac.nz/\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e*.canterbury.ac.nz\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ekoawa.co.nz\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003ehitlabnz.org\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003e- ucsa.org.nz\u003c/h2\u003e\n\n\u003cp\u003eTesting  Information\u003c/p\u003e\n\n\u003cp\u003eThis program covers all public facing UC-owned applications, services, and properties, including any browser UI and web service.\u003c/p\u003e\n\n\u003cp\u003eThe following IP Range is in scope: 131.181.(109/106/).XX\u003c/p\u003e\n\n\u003cp\u003eExamples include:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eUC web sites\u003c/li\u003e\n\u003cli\u003eUC email domains\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"d11e70bd-c81d-4649-9d45-a75e71aae058","code":"university-canterbury-vdp-pro","state":"in_progress","endsAt":"2026-04-29T18:00:00Z","bountyId":"4fc03c21-d7f2-415e-8d97-46d2a37f624e","startsAt":"2025-06-10T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Education","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/3f7e/826a/d0f78ced/a58f55915330f1e5d19dc75e462129d6_university_of_canterbury_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-06-10T18:00:02.799Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/university-canterbury-vdp-pro","changelogs":"/engagements/university-canterbury-vdp-pro/changelog","submissions":null,"announcements":"/engagements/university-canterbury-vdp-pro/announcements","hallOfFame":"/engagements/university-canterbury-vdp-pro/hall_of_fames","crowdstream":"/engagements/university-canterbury-vdp-pro/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/university-canterbury-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=university-canterbury-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/university-canterbury-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/university-canterbury-vdp-pro/changelog","publishedAt":"2025-11-20T01:32:13.276Z","engagementChangelogUrl":"/engagements/university-canterbury-vdp-pro/changelog/60d02fdf-24a4-47b6-a6ce-e34803cfbfee","createUserFeedbacksUrl":"/engagements/university-canterbury-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/university-canterbury-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}