{"id":"15e0c0da-a79e-40b3-8835-2feee7ec99be","engagementId":"0e684f5a-0bf3-47c3-81b4-27bc2b18c9fa","data":{"brief":{"id":"3971f0da-5a7e-4a04-9c78-d2fa9d583bad","name":"Upwork","tagline":"Upwork invites researchers to test our marketplace and apps to ensure a secure, vulnerability-free platform for our users","description":"\u003ch1\u003eUpwork\u003c/h1\u003e\n\n\u003cp\u003eFor this program, we're inviting researchers to test our freelancer platform and mobile iOS/Android/Desktop apps.  Our goal with this program is to ensure that our customers are using a secure platform that's free of security vulnerabilities.\u003c/p\u003e\n\n\u003cp\u003ePlease note: Upwork regularly releases new code, updates will be posted in the announcement section highlighting new code. This is a great opportunity for Upwork and the researcher community to work together to find vulnerabilities! Watch for new releases on \u003ca href=\"https://www.upwork.com/blog/get-weekly-updates-upwork-blog/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eUpwork's Blog\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSpecial Bonuses and Rewards\u003c/h2\u003e\n\n\u003ch3\u003eCTF\u003c/h3\u003e\n\n\u003ch4\u003eUpwork is offering a \u003cstrong\u003ean extra, one-time $5,000 reward\u003c/strong\u003e for the ability to find reverse shell, bind shell, or meterpreter shell\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eResearchers need to get reverse shell, bind shell, or meterpreter shell of any Upwork in-scope instance and provide a PoC.\u003c/li\u003e\n\u003cli\u003ePlease provide complete reproduction steps for how you were able to capture the flag\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eOngoing\u003c/h3\u003e\n\n\u003cp\u003e\u003cstrong\u003eMomentum Bonus\u003c/strong\u003e, the more you submit, the more you earn!\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThere is a 7-day sliding window where you can build momentum on your rewards for the Upwork program, going forward, submissions made within the 7-day sliding window will be sorted by the severity assigned and the momentum bonus will be applied from highest to lowest severity, for example if you submit 3 bugs in this sequence [P3, P2, P1] within a 7 day sliding window, the submissions will be sorted by severity [P1, P2, P3] and the first (Bug with P1 Severity) pays 100%, the second (Bug with P2 Severity) pays 110%, the third (Bug with P3 Severity) pays 120%, etc.  \u003cstrong\u003eThis scales to a maximum payout amount of 200% (double reward) the original value.\u003c/strong\u003e \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eUpwork is offering \u003cstrong\u003ean extra, one-time $5,000 reward\u003c/strong\u003e for the ability to break into any of the specified \u003ccode\u003eclient\u003c/code\u003e or \u003ccode\u003efreelancer\u003c/code\u003e accounts and steal the funds allocated to it. The account is: \u003ccode\u003ebugcrowd-client@upwork.com\u003c/code\u003e and \u003ccode\u003ebugcrowd-freelancer@upwork.com\u003c/code\u003e.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease provide complete reproduction steps for how you were able to capture the flag\u003c/li\u003e\n\u003cli\u003eBruteforcing credentials to break in is still out of scope as per the regular scoping rules.\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eUse of Social Engineering to take-over the account is still out of scope as per the regular scoping rules.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eDisclosure terms\u003c/h3\u003e\n\n\u003cp\u003eThis program has a coordinated disclosure policy. Disclosures requests will be reviewed on a case by case basis.\u003c/p\u003e\n\n\u003chr\u003e","industryTagId":"d3470382-2d32-46e3-91bd-1f826d434c6f","targetsOverview":"\u003cp\u003e\u003cem\u003eAny domain/property of Upwork not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Upwork, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings (with a few exceptions), this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eHowever, it is essential to note that in some cases, a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003ePlease see Target Information for exclusions specific to this program.\u003c/strong\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSubmissions\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease ensure to differentiate which program you are reporting from.  (i.e. Incremental vs. Original)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRequirements\u003c/h2\u003e\n\n\u003cp\u003eThe following requirements are needed to test - \u003cstrong\u003e\u003cem\u003enot abiding by these rules may result in you not being ineligible from receiving the full reward amount or may lead to being suspended from testing and/or removal from the program.\u003c/em\u003e\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003e\u003cstrong\u003eUser-Agent\u003c/strong\u003e - To participate in the Upwork Bug Bounty, please configure your scanner to include \u003ccode\u003ebugcrowd\u003c/code\u003e in the user-agent string. Failure to do so may result in your IP being temporarily blocked from participation in the program.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003cstrong\u003eAccess / Upwork Account\u003c/strong\u003e -  You can self-register for an Upwork account and Upwork API using your \u003ccode\u003e@bugcrowdninja.com\u003c/code\u003e email address. Testing using any other account is out of scope. Failure to use your \u003ccode\u003e@bugcrowdninja.com\u003c/code\u003e address may result in your account being temporarily locked or being suspended from participating in the program.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eTarget information\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease note that the mobile web app is available at: \u003ca href=\"https://upwork.com/mobile\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://upwork.com/mobile\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eInformation on the public messaging API is available at: \u003ca href=\"https://developer.upwork.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developer.upwork.com\u003c/a\u003e and also attached to the listing.\u003c/li\u003e\n\u003cli\u003eTo view a list of what will likely be the \u003cstrong\u003ebest areas to focus on\u003c/strong\u003e to find valid and unique findings, please go \u003cspan class=\"rp-resources__download-link bc-m-0 bc-icon bc-icon--after cc-icon--download\" data-tooltip-id=\"8d4f7413-6261-4c65-8a04-254f5457e560\"\u003e\u003ca href=\"https://bugcrowd.com/engagements/upwork/attachments/8d4f7413-6261-4c65-8a04-254f5457e560\" download\u003ehere\u003c/a\u003e\u003c/span\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://play.google.com/store/apps/details?id=com.upwork.android.apps.client\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAndroid application, Clients\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://play.google.com/store/apps/details?id=com.upwork.android.apps.main\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAndroid application, Freelancers\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://apps.apple.com/ky/developer/upwork-global-inc/id329377609\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eiOS applications\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://developers.upwork.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eUpwork Developers\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWorth noting, Upwork is designed to help people find jobs and posting/viewing resumes and other PII is a core component of the service. While you may submit findings, it must have a clear threat or business impact for Upwork; otherwise, it is likely to be marked as won't fix or informational. \u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.upwork.com/careers/engineering-blog/upwork-bug-bounty-treasure-map\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eUpwork Bug Bounty Treasure Map\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eAccess/credentials\u003c/h2\u003e\n\n\u003cp\u003ePlease sign up for an Upwork account and Upwork API using your \u003ccode\u003e@bugcrowdninja.com\u003c/code\u003e email address. Only basic/free access is provided by the Upwork team for this program, you are welcome to test the API using a paid account, but these are not offered at this time.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://www.upwork.com/services/api/apply\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSign up for Upwork API\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.upwork.com/hc/en-us/sections/202260468-Get-Started-as-a-Client\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHow do I get started as a client?\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.upwork.com/hc/en-us/articles/211067578-Getting-Started-as-a-Freelancer\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGetting Started as a Freelancer\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\n\u003ca href=\"https://www.upwork.com/careers/engineering-blog/upwork-bug-bounty-treasure-map\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eUpwork Bug Bounty Treasure Map\u003c/a\u003e \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen testing please only test against jobs that you have created - do not test against jobs owned by persons other than yourself\u003c/strong\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExclusions\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll CSRF vulnerabilities will likely be evaluated at the P4 level\u003c/li\u003e\n\u003cli\u003eSocial Engineering\u003c/li\u003e\n\u003cli\u003eUploading of any vulnerability or client-related content to third-party utilities (e.g., Github, DropBox)\u003c/li\u003e\n\u003cli\u003eNetwork-layer D/DoS (If you suspect an application-layer D/DoS, contact Bugcrowd to review the vulnerability. Do not proof-of-concept application-layer D/DoS attacks without prior consent)\u003c/li\u003e\n\u003cli\u003eAll attack payload data must use professional language (ex: \"test\" rather than \"this has been hacked.\")\u003c/li\u003e\n\u003cli\u003eIf able to gain access to a system, accounts, users, or user data, stop at the recognition of and report. Do not dive deeper to determine how much more is accessible.\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting users of outdated browsers, plugin, platforms, or operating systems.\u003c/li\u003e\n\u003cli\u003eGithub Repos not associated with \u003ccode\u003ecloud.upwork.com\u003c/code\u003e or \u003ccode\u003eupwork.com.\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003e2FA exploits are of low value for this team and will be marked as Not Applicable \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eAdditionally, the following vulnerabilities are considered too low of an impact and will be marked as Out of Scope if submitted\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch3\u003eWeb\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eUser Account Social Media Account (Twitter for example) hijacking via a broken link\u003c/li\u003e\n\u003cli\u003eAccount/email enumeration using brute-force attacks\u003c/li\u003e\n\u003cli\u003eAny low impact issues related to session management (i.e., concurrent sessions, session expiration, password reset/change logout, etc.)\u003c/li\u003e\n\u003cli\u003eBypassing content restrictions in uploading a file without proving the file was received\u003c/li\u003e\n\u003cli\u003eClickjacking/UI redressing\u003c/li\u003e\n\u003cli\u003eIncomplete or missing SPF/DMARC/DKIM records\u003c/li\u003e\n\u003cli\u003eIssues related to password/credential strength, length, lockouts, or lack of brute-force/rate-limiting protections\u003c/li\u003e\n\u003cli\u003eLack of SSL or Mixed content\u003c/li\u003e\n\u003cli\u003eMissing Cookie flags\u003c/li\u003e\n\u003cli\u003eReflected file download attacks (RFD)\u003c/li\u003e\n\u003cli\u003eSelf-exploitation (i.e., password reset links or cookie reuse)\u003c/li\u003e\n\u003cli\u003eURL Redirection\u003c/li\u003e\n\u003cli\u003eUse of a known-vulnerable library which leads to a low-impact vulnerability (i.e., outdated jQuery version leads to low impact XSS)\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting users of outdated browsers, plugins or platforms\u003c/li\u003e\n\u003cli\u003eVulnerabilities that allow for the injection of arbitrary text without allowing for hyperlinks, HTML, or JavaScript code to be injected\u003c/li\u003e\n\u003cli\u003eVulnerabilities that require the user/victim to perform improbable actions (i.e., Self-XSS)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eAndroid\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eandroid:debuggable=\" true\" in Android Manifest\u003c/li\u003e\n\u003cli\u003eandroid:allowBackup set to true (by default)\u003c/li\u003e\n\u003cli\u003eInformation disclosure via Toast messages\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eiOS\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eInformation leakage in backgrounding snapshots\u003c/li\u003e\n\u003cli\u003eInformation leakage in keystroke caching\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eBoth\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eCopy \u0026amp; Paste disabled for sensitive fields\u003c/li\u003e\n\u003cli\u003ePasteboard data cached\u003c/li\u003e\n\u003cli\u003eThe application asks for more permission than its needs\u003c/li\u003e\n\u003cli\u003eTwo-factor authentication bypass that requires physical access to a logged-in device\u003c/li\u003e\n\u003cli\u003eAny issue in the mobile app that can only be exploited on a rooted or jailbroken device\u003c/li\u003e\n\u003cli\u003eAny issue exploited in the mobile app because of an operating system vulnerability\u003c/li\u003e\n\u003cli\u003eLocal access to user data when operating a rooted mobile device\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eThis list will be updated if we see a particular vuln that is systemic and sitewide. Please check this list often. This is for your benefit and to save you the trouble of searching the analytics\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003ePrivacy Considerations are OOS\u003c/h2\u003e\n\n\u003cp\u003eUpwork is Privacy Shield certified. Upwork has received TRUSTe's Privacy Seal signifying that our privacy policy and practices comply with the TRUSTe program requirements, including transparency, accountability, and choice regarding the collection and use of personal information. Upwork is GDPR compliant. \u003c/p\u003e","safeHarborStatus":null,"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"e04feb1b-d6e8-4e82-ba94-823ebbb24512","name":"In scope","targets":[{"id":"7e030a9d-4344-4b4f-a0db-8b32e089f482","uri":"https://www.upwork.com","name":"www.upwork.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"dca6df1e-c7a0-4210-8b7f-7c06fa85d307","sortOrder":0},"sortOrder":0,"tags":[{"id":"2737f40b-dd43-41a3-bc20-94069ed37230","name":"Fastly","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"b4625bc4-6058-4ea0-acc1-a8b16d21c531","name":"Mailgun","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"ce8ff3cd-4d54-4404-8321-6351781551a3","name":"Vue.js","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"7e030a9d-4344-4b4f-a0db-8b32e089f482"}],"recentChangeFlags":null},{"id":"78eeb46b-7c2a-4357-b750-93689c5d71b6","uri":null,"name":"Upwork - Android Application","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e08f11e6-ed52-48a7-beac-e7cb1de74537","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"78eeb46b-7c2a-4357-b750-93689c5d71b6"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"78eeb46b-7c2a-4357-b750-93689c5d71b6"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"78eeb46b-7c2a-4357-b750-93689c5d71b6"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"78eeb46b-7c2a-4357-b750-93689c5d71b6"}],"recentChangeFlags":null},{"id":"26bf8663-8925-496e-b08c-18e077f5683d","uri":null,"name":"Upwork - iOS Application","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"53bd3dd3-9390-467a-ad4e-dfa19bd19ee6","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"26bf8663-8925-496e-b08c-18e077f5683d"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"26bf8663-8925-496e-b08c-18e077f5683d"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"26bf8663-8925-496e-b08c-18e077f5683d"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"26bf8663-8925-496e-b08c-18e077f5683d"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"26bf8663-8925-496e-b08c-18e077f5683d"}],"recentChangeFlags":null},{"id":"3aac9970-0f11-462f-a022-6f9a960c890b","uri":null,"name":"Upwork Dash Messenger Desktop Version (www.upwork.com/downloads)","category":"hardware","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a0dd3188-7485-46f7-8719-f70b5b5c1573","sortOrder":0},"sortOrder":0,"tags":[{"id":"fc8162a2-8e37-4a27-8cbd-3b40e7799f4e","name":"Desktop Application Testing","targetId":"3aac9970-0f11-462f-a022-6f9a960c890b"}],"recentChangeFlags":null},{"id":"34c31ef5-d643-41c5-aed8-23956ce51987","uri":null,"name":"www.upwork.com/api ","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"eb702d39-a386-4d55-bf6a-878bb69e7e26","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"34c31ef5-d643-41c5-aed8-23956ce51987"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"34c31ef5-d643-41c5-aed8-23956ce51987"}],"recentChangeFlags":null},{"id":"0d4320e4-47a5-47a6-b57d-d70a39dd3a9e","uri":null,"name":"Direct Contracts","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ba5565a9-d64b-467d-a4d4-7a83cdeb6064","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0d4320e4-47a5-47a6-b57d-d70a39dd3a9e"}],"recentChangeFlags":null},{"id":"9dde0d2e-bcde-406a-9e3b-fd74461e5843","uri":null,"name":"api.upwork.com/graphql","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"34e7577e-3560-453d-87df-bd2162d40585","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"9dde0d2e-bcde-406a-9e3b-fd74461e5843"},{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"9dde0d2e-bcde-406a-9e3b-fd74461e5843"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"16787c2e-ba98-4a9b-83ea-af0657ebad75","p1MaxCents":500000,"p1MinCents":500000,"p2MaxCents":200000,"p2MinCents":200000,"p3MaxCents":72000,"p3MinCents":48000,"p4MaxCents":30000,"p4MinCents":12000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":1000000},"descriptionHtml":"\u003cp\u003e\u003cstrong\u003eFocus Area:\u003c/strong\u003e Recently migrated from Angular to Vue.js and findings related to this change are of great interest to the Upwork team \u003c/p\u003e","rewardRangeData":{"1":{"min":5000,"max":5000},"2":{"min":2000,"max":2000},"3":{"min":480,"max":720},"4":{"min":120,"max":300},"5":{"min":null,"max":null},"programMax":10000},"recentChangeFlags":null},{"id":"8d0cd29b-f312-40f4-bc26-d5b2195a8638","name":"Non-Circumvention Controls Targets","targets":[{"id":"14d4c177-db21-4363-af06-763d9dc58cb8","uri":"","name":"Upwork - Marketplace Portal","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c2021a90-484f-483e-93d6-6ee5c4f4fa0d","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"33c7a332-eb38-4634-b7b0-33e89a2cf327","uri":"","name":"Upwork - Messages","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1278726e-d363-4990-b9de-1e3142df5746","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"2c4882d8-1bdb-47d5-92c2-09ac9687af69","uri":"","name":"Upwork - Mobile Application IOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"61161051-7225-4a0b-a6f5-39dca35ac567","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e7b119d0-e49c-4b2c-b375-f21de6be2d39","uri":"","name":"Upwork - Mobile Application Android","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d7962a33-bb47-4a49-bd84-9826f8dd66ea","sortOrder":0},"sortOrder":0,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"e7b119d0-e49c-4b2c-b375-f21de6be2d39"}],"recentChangeFlags":null},{"id":"0b082158-cb62-40f6-b430-49df49bc7664","uri":"","name":"Upwork - api.upwork.com/graphql","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f28ed63c-d178-4111-acad-b04f673fe2fc","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"40793779-22f9-4e63-a784-70eb98f85fc9","p1MaxCents":200000,"p1MinCents":200000,"p2MaxCents":100000,"p2MinCents":100000,"p3MaxCents":50000,"p3MinCents":50000,"p4MaxCents":25000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003e\u003cstrong\u003eScope Description\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eFor this scope, we\u0026#39;re inviting researchers to test our existing User Agreement Non-Circumvention Controls on our Marketplace and mobile iOS/Android/Desktop apps, as well as help us to discover unknown loopholes that can be exploited to gain directs access or share contact information. Our goal is to ensure that our clients and freelancers are using our platform in compliance with \u003ca href=\"https://www.upwork.com/legal#NONCIRCUMVENTION\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eUser Agreement Section 7\u003c/a\u003e specifically.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eSpecial Bonuses and Rewards\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eOngoing and until we reward $10000 total for all submissions reported under this sub-program. We may extend this program in the future based on results.\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eMomentum Bonus\u003c/strong\u003e, the more you submit, the more you earn!\u003c/li\u003e\n\u003cli\u003eThere is a 7-day sliding window where you can build momentum on your rewards for this program, going forward, submissions made within the 7-day sliding window will be sorted by the severity assigned and the momentum bonus will be applied from highest to lowest severity, for example if you submit 3 bugs in this sequence [P3, P2, P1] within a 7 day sliding window, the submissions will be sorted by severity [P1, P2, P3] and the first (Bug with P1 Severity) pays 100%, the second (Bug with P2 Severity) pays 110%, the third (Bug with P3 Severity) pays 120%, etc. \u003cstrong\u003eThis scales to a maximum payout amount of 200% (double reward) the original value.\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eDisclosure Terms\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThis program has a coordinated disclosure policy. Disclosure requests will be reviewed on a case-by-case basis.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":2000,"max":2000},"2":{"min":1000,"max":1000},"3":{"min":500,"max":500},"4":{"min":250,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"6849709d-1ea7-4465-9e2d-a2346a513baf","name":"Out of Scope","targets":[{"id":"a7c554d5-8908-4959-a7c1-4736b37bcf01","uri":null,"name":"Social media hijacking","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"61e8065c-ab39-4c5d-bb70-8e123b6ecfbc","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"14031ca7-b36f-4c80-9c92-ceb3c387c894","uri":null,"name":"Any subdomain/domain/property not listed in the 'in scope' section, is out of scope. ","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9088bed5-f837-466d-b6dc-2ba28500f705","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e31d26aa-f890-442f-9ada-42ba6e93e06b","uri":null,"name":"Any Third-party Services","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cc26d127-d93e-449a-90b2-6ef0fe69b863","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e31d26aa-f890-442f-9ada-42ba6e93e06b"}],"recentChangeFlags":null},{"id":"0c10c399-3a92-4499-b48a-39a85c5585fd","uri":null,"name":"support.upwork.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b317c5f8-d5e4-4276-ba09-5b811a680054","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0c10c399-3a92-4499-b48a-39a85c5585fd"}],"recentChangeFlags":null},{"id":"ad2ab8b4-34ed-4ee7-a525-a64e7a934b3f","uri":null,"name":"community.stage.upwork.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cf1f7716-3be6-4d6b-9cb8-c65b2c2609ef","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ad2ab8b4-34ed-4ee7-a525-a64e7a934b3f"}],"recentChangeFlags":null},{"id":"72f31a99-5d08-49fb-b350-0cb3f64c4045","uri":null,"name":"community.upwork.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c7338269-afee-4232-abb6-dd0b82c3c25b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"72f31a99-5d08-49fb-b350-0cb3f64c4045"}],"recentChangeFlags":null},{"id":"1f40af32-f72b-445c-8085-794a12347f97","uri":null,"name":"stage.upwork.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"eaf9a946-81b9-4740-af30-877a99fa2626","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1f40af32-f72b-445c-8085-794a12347f97"}],"recentChangeFlags":null},{"id":"797123a0-72c7-4e31-b4ef-410c18710e13","uri":null,"name":"e.upwork.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9dbea923-2940-466a-8ae7-39b22d28fdb9","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"797123a0-72c7-4e31-b4ef-410c18710e13"}],"recentChangeFlags":null},{"id":"6e994f76-484f-4340-89b7-c75618fc5b84","uri":null,"name":"status.upwork.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0fdb3ff4-72bd-4541-a498-1dc33127b1ac","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6e994f76-484f-4340-89b7-c75618fc5b84"}],"recentChangeFlags":null},{"id":"b2d417d8-c7b2-4481-a61c-5903be8b7836","uri":null,"name":"signature.upwork.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d7d2cf0c-a49a-4ba4-bd5f-10be5bc1f471","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"d1b0bfba-fd17-4add-8e9d-5c55afdb0b95","uri":null,"name":"careers.upwork.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fb0c0f33-012d-4e9e-9207-a5368e9539c2","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"1e93b339-afa0-4d25-bd11-690baaf9ef14","uri":"","name":"tip.upwork.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7d5da6f6-9c31-41e5-ae41-4fab12369aa9","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"f67e6ef7-3b8d-423d-ae52-e516204fcacc","uri":"","name":"tip.upwork.com ","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1cf1d48e-5239-4765-a634-3068faf8eeeb","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f67e6ef7-3b8d-423d-ae52-e516204fcacc"}],"recentChangeFlags":null},{"id":"c8c377f2-e3be-4d4c-b12f-8be0851e51f0","uri":null,"name":"pardot.upwork.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"23336151-b809-4b55-9d45-ff216edaa55e","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c8c377f2-e3be-4d4c-b12f-8be0851e51f0"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":"\u003cul\u003e\n\u003cli\u003eAll already known loopholes and planned remediation will not be rewarded.\u003c/li\u003e\n\u003cli\u003eBrute Forcing credentials to break into accounts is outside of scope. \u003c/li\u003e\n\u003cli\u003eThe use of Social Engineering is out of scope. \u003c/li\u003e\n\u003cli\u003eSoliciting circumvention as a means of root cause identification.\u003c/li\u003e\n\u003cli\u003eFinding direct contact information through externally posted sources by either client or freelancer is out of scope unless this information is clearly linked from within the Upwork Marketplace and was not known to Upwork trust and safety teams already.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[{"id":"8d4f7413-6261-4c65-8a04-254f5457e560","attachmentPath":"https://bugcrowd.com/engagements/upwork/attachments/8d4f7413-6261-4c65-8a04-254f5457e560","name":"Upwork%20Focus%20Areas.docx","filename":"Upwork%20Focus%20Areas.docx","description":null,"icon":"fileOther","size":14105,"sizeLabel":"13.8 KB","uploadedAt":"31 Jul 2025","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/upwork/attachments/8d4f7413-6261-4c65-8a04-254f5457e560"}],"engagement":{"id":"0e684f5a-0bf3-47c3-81b4-27bc2b18c9fa","code":"upwork","state":"in_progress","endsAt":null,"bountyId":"e5dae420-ecc1-4eb7-9d5b-e30121913477","startsAt":"2018-06-19T13:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Corporate Services","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/2588/cc10/bf2e0ce4/84a6821a6ab01e5904e1867aee28fac7_new_300_UpworkLogo_UpGreen_WithClearspace.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2018-06-19T13:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/upwork","changelogs":"/engagements/upwork/changelog","submissions":null,"announcements":"/engagements/upwork/announcements","hallOfFame":"/engagements/upwork/hall_of_fames","crowdstream":"/engagements/upwork/crowdstream"},"announcementsCount":36,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/upwork/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=upwork\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/upwork/engagement_subscribers","engagementChangelogsUrl":"/engagements/upwork/changelog","publishedAt":"2025-07-31T19:48:19.946Z","engagementChangelogUrl":"/engagements/upwork/changelog/15e0c0da-a79e-40b3-8835-2feee7ec99be","createUserFeedbacksUrl":"/engagements/upwork/feedbacks","engagementCrowdstreamUrl":"/engagements/upwork/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}