{"id":"3d692266-89d0-42d6-a49b-1430f275ec8f","engagementId":"50c9f1cc-1e58-4049-9556-3de764ce6c31","data":{"brief":{"id":"afbccba3-49dc-41f3-bebd-f884da597af0","name":"Viator","tagline":"Viator - Travel with an Insider","description":"\u003cp\u003eWe appreciate all security concerns brought forth and are constantly striving to keep on top of the latest threats. Being pro-active rather than re-active to emerging security issues is a fundamental belief at Viator. Every day new security issues and attack vectors are created. Viator strives to keep abreast on the latest state-of-the-art security developments by working with security researchers and companies. We appreciate the community's efforts in creating a more secure world.\u003c/p\u003e\n\n\u003cp\u003eGood luck, and happy hunting! \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"948573e8-bbbb-4552-918a-f87250ebe1fc","targetsOverview":"\u003cp\u003e\u003cem\u003eOnly the ‘In Scope’ targets listed above are in scope for this engagement. Any subdomain/domain/property not listed is out of scope.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eProgram Guidelines\u003c/h2\u003e\n\n\u003cp\u003eWe would like to get as broad coverage as possible but we also have to be sensitive to our suppliers, as well as our users, so we would like all testing to be done with an awareness that some actions will directly affect many people outside of our company. For example, a review of a tour which contains incorrect statements about the tour could negatively affect future bookings for that tour and the supplier. Another example is making test bookings on production for real products and suppliers. The supplier may not necessarily be aware they are test bookings. This can result in unused inventory for the supplier. Accordingly, we request that testers abide by the guidelines below.\u003c/p\u003e\n\n\u003cp\u003eOur primary interest is finding security holes. We are not at this time interested in attacks on content quality, vulnerability to spamming, manipulation of tour ratings, or manipulation of user generated content (user submitted tour reviews and photos).\u003c/p\u003e\n\n\u003ch2\u003e\u003cem\u003eWhenever making any test bookings, signing up as a partner, or initiating any Live Chats always use 'BUGCROWD' in the name or language\u003c/em\u003e\u003c/h2\u003e\n\n\u003cp\u003eWe would request that you keep test bookings to a minimum. But they are possible and necessary to test the payment and post-purchase workflows on our systems.\u003c/p\u003e\n\n\u003cp\u003eTo make a test booking please follow the following rules...\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eMake sure the surname for all travelers is TEST\u003c/li\u003e\n\u003cli\u003e Make sure you add \"This is a test booking - please ignore\" in the Special Requirements field\u003c/li\u003e\n\u003cli\u003e Please only book the following product codes: \u003ccode\u003e73111P1, 73111AUTOTEST1, 73111AUTOTEST5, 73111AUTOTEST8, 73111AUTOTEST10\u003c/code\u003e\n-- Note: to use a test product you'll need to search for it directly in the search box on the homepage\n-- Test products do not return in product searches and are not on any of the listings pages\n-- URL will look like this: https://www.viator.com/tours/Barcelona/Automated-Test-Product-Only/d562-73111AUTOTEST10\u003c/li\u003e\n\u003cli\u003eMake sure it is booked for a date at least 3 months in advance\u003c/li\u003e\n\u003cli\u003eUse your own credit card to complete the booking\u003c/li\u003e\n\u003cli\u003eOnce your testing is complete please go into the booking self service screen and cancel your booking for a full refund to your credit card. Please make sure to do this at least 2 months before the original booking date \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eTo make a test Suppliers through Viator's supplier sign up page, start the supplier name with 'BUGCROWD' \u003c/p\u003e\n\n\u003ch2\u003ePlease make sure to accurately follow the above steps to avoid a charge to your credit card\u003c/h2\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eTo gain access, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eFingerprinting / banner disclosure on common/public services\u003c/li\u003e\n\u003cli\u003eHTTPS Mixed Content Scripts\u003c/li\u003e\n\u003cli\u003eIncomplete or missing or misconfigured SPF/DKIM/DMARC issues\u003c/li\u003e\n\u003cli\u003eExploits around mass content submission, account creation or spamming\u003c/li\u003e\n\u003cli\u003eDisruption of service either through DOS attacks, exploitation of performance problems, or trying to fill up a database\u003c/li\u003e\n\u003cli\u003eSocial engineering attacks\u003c/li\u003e\n\u003cli\u003eAttacks requiring physical access to Viator locations or property\u003c/li\u003e\n\u003cli\u003eExploits against mobile applications requiring physical access to the device or that require warranty voiding actions (e.g., rooting the device)\u003c/li\u003e\n\u003cli\u003eExploits against the site from webviews within mobile applications NOT published by Viator\u003c/li\u003e\n\u003cli\u003eAll vulnerabilities related to throttling requests across partners.viator.com and their subdomains. This includes mass account creation, repeated signup/login attempts, repeated triggering of built in emails (like reset password / welcome etc.).\u003c/li\u003e\n\u003cli\u003eSubmissions of “no session expiry on logout” and any similar submissions on the iframe.\u003c/li\u003e\n\u003cli\u003eAll vulnerabilities related to Firebase-native behavior\u003c/li\u003e\n\u003cli\u003eAny vulnerabilities in regards to a feature that requires KYC verification is out of scope on \u003cstrong\u003epartners.viator.com\u003c/strong\u003e, Viator does not have a process for researchers to be verified securely\u003c/li\u003e\n\u003cli\u003eWe are interested in reports of leaked API keys and secrets that grant access to in-scope assets; however, leaked usernames and passwords from third-party breaches are strictly out of scope.\u003c/li\u003e\n\u003cli\u003eAll vulnerabilities and issues related to email verification flows (including lack of verification, bypasses, or rate limiting) will be strictly classified as P5 (Informational).\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have questions or concerns, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"06e8b79d-b748-4566-b132-423c2521cec7","name":"Viator In Scope Targets ","targets":[{"id":"aa17ad22-ed00-476d-a408-c2a2dda144fc","uri":"https://apps.apple.com/us/app/viator-tours-activities/id434832826","name":"iOS Viator Tours \u0026 Activities App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"df879f19-efc9-4129-a37e-a7583b428c6f","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"aa17ad22-ed00-476d-a408-c2a2dda144fc"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"aa17ad22-ed00-476d-a408-c2a2dda144fc"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"aa17ad22-ed00-476d-a408-c2a2dda144fc"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"aa17ad22-ed00-476d-a408-c2a2dda144fc"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"aa17ad22-ed00-476d-a408-c2a2dda144fc"}],"recentChangeFlags":null},{"id":"54f74c20-e194-4dd6-83f6-a96d84556f33","uri":"https://play.google.com/store/apps/details?id=com.viator.mobile.android\u0026hl=en_US\u0026gl=US","name":"Android Viator Tours \u0026 Activities App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"702c39df-0911-42ce-85cc-08c81c8763d8","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"54f74c20-e194-4dd6-83f6-a96d84556f33"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"54f74c20-e194-4dd6-83f6-a96d84556f33"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"54f74c20-e194-4dd6-83f6-a96d84556f33"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"54f74c20-e194-4dd6-83f6-a96d84556f33"}],"recentChangeFlags":null},{"id":"b307f659-430c-4f80-9324-2a0cac65d54d","uri":"https://supplier.viator.com/","name":"https://supplier.viator.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e0304768-b597-4d99-8ef8-65d3bb024d9c","sortOrder":0},"sortOrder":0,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"b307f659-430c-4f80-9324-2a0cac65d54d"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"b307f659-430c-4f80-9324-2a0cac65d54d"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b307f659-430c-4f80-9324-2a0cac65d54d"}],"recentChangeFlags":null},{"id":"ac9db698-aad2-4738-b758-4355d6eabdc3","uri":"https://www.toursgds.com/","name":"https://www.toursgds.com/","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"09930b14-1f5a-4b64-ac61-fb93b7b13b98","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"ac9db698-aad2-4738-b758-4355d6eabdc3"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"ac9db698-aad2-4738-b758-4355d6eabdc3"}],"recentChangeFlags":null},{"id":"0354a0b0-b104-47ed-a8e5-dbefe4fa0acd","uri":"https://www.toursgds.com/ToursGdsService?wsdl","name":"https://www.toursgds.com/ToursGdsService?wsdl","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"72ef0d2a-bc25-4821-b707-b8cc12b63bd0","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"0354a0b0-b104-47ed-a8e5-dbefe4fa0acd"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"0354a0b0-b104-47ed-a8e5-dbefe4fa0acd"}],"recentChangeFlags":null},{"id":"4fa21f06-cf51-4ff4-9cd7-3cf971c26a52","uri":"https://www.toursgds.com/SupplierService?wsdl","name":"https://www.toursgds.com/SupplierService?wsdl","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"95d55985-6dfd-45f7-9911-0384b337a6df","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"4fa21f06-cf51-4ff4-9cd7-3cf971c26a52"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"4fa21f06-cf51-4ff4-9cd7-3cf971c26a52"}],"recentChangeFlags":null},{"id":"5ace17c2-4555-49f5-aee5-20231644fe68","uri":"https://partners.viator.com","name":"https://partners.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4cd7eff6-3f14-4aac-b45a-13a8d8e2720e","sortOrder":0},"sortOrder":0,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"5ace17c2-4555-49f5-aee5-20231644fe68"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5ace17c2-4555-49f5-aee5-20231644fe68"}],"recentChangeFlags":null},{"id":"0684f2ff-234e-4a7f-88ea-ed7b8d12cbb8","uri":"https://travelagents.viator.com","name":"travelagents.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d343652b-9d56-45a8-b1e6-bd7fa6e53a9f","sortOrder":0},"sortOrder":0,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"0684f2ff-234e-4a7f-88ea-ed7b8d12cbb8"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"0684f2ff-234e-4a7f-88ea-ed7b8d12cbb8"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0684f2ff-234e-4a7f-88ea-ed7b8d12cbb8"}],"recentChangeFlags":null},{"id":"0b508099-16c7-4e9d-9ba8-b433043df7b0","uri":"https://help.supplier.viator.com/en","name":"https://help.supplier.viator.com/en","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"657be80a-8b1b-46dc-9d75-a66ab25ceb02","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"d2fa9733-4e9c-4ca2-b680-a35dd9c75ec6","uri":"https://kiwi.partner.viator.com","name":"kiwi.partner.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9d932b3a-2a8d-4321-990d-a74e022a8162","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"1895b143-dd7f-417e-bab5-b1c28dbb22f4","uri":"https://*.viatorinc.com","name":"*.viatorinc.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"eb67f161-d840-4482-8885-51fba08f7c69","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1895b143-dd7f-417e-bab5-b1c28dbb22f4"}],"recentChangeFlags":null},{"id":"4566f276-5fb9-46d4-a961-6b7448000fdc","uri":"https://selector.viator.com","name":"selector.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6bb1f415-c4d5-4216-be6c-9601a3cb6411","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"9c756f15-3937-4411-a56b-53f1538754b7","uri":"https://partnerhelp.viator.com/","name":"partnerhelp.viator.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"70700628-d128-4f15-9e1b-733c9a9ccee6","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7255c426-3520-4282-86c5-4c4c91a28a7e","uri":"https://*.viator.com","name":"*.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8eac6221-9cd1-4456-a847-3c77fc5034ad","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"26866556-3a24-434a-9a42-83e2488fb13c","p1MaxCents":450000,"p1MinCents":410000,"p2MaxCents":230000,"p2MinCents":200000,"p3MaxCents":85000,"p3MinCents":60000,"p4MaxCents":25000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eTarget Information\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://viatorapi.viator.com/service/directory\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://viatorapi.viator.com/service/directory\u003c/a\u003e - Please use Api Key = \u003ccode\u003e6375393012636041517\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eFor security reasons, viator.com iframes its proxy as gtm-orn.viator.com on some pages. Viator is very focused on making sure the iframes are secure and gtm-orn.viator.com is in scope, however, Viator is not interested in reports of “no session expiry on logout” and similar submissions.\u003c/p\u003e\n\n\u003cp\u003ePlease note - The same issued raised on multiple language sites will be treated as duplicates.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNote on Customer API Keys: Reports of leaked or exposed Customer API keys will be rated as P4 and are eligible for points only (no monetary reward).\u003c/strong\u003e\u003c/p\u003e","rewardRangeData":{"1":{"min":4100,"max":4500},"2":{"min":2000,"max":2300},"3":{"min":600,"max":850},"4":{"min":200,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"04f8d2a5-5b0c-4156-b68b-83e45e9290b7","name":"Viator Out of Scope Targets","targets":[{"id":"e332a466-21fd-49f4-83dc-6e823fd060c0","uri":null,"name":"*.rc.viator.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3319b080-ab73-4b7e-8488-ad800ca74e4f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"992dd77d-6321-4955-bb2e-64617fceab04","uri":null,"name":"*.sandbox.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f7ef7ca9-b1d7-4f1d-b753-fa85842b43b3","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"7f2860fd-a525-4201-a85d-ca9f326e9057","uri":null,"name":"*.partner.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c38dee8a-17b6-4e08-a24d-08de44a1b9f3","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"cdb47087-6511-4dbd-b4b0-aea616f2d620","uri":"","name":"agentcenter.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"30ef55f2-0dae-4907-9938-563051dee331","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"1352f3e7-d91f-4a50-a9c6-0464529a3308","uri":"","name":"operatorresources.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"40c9f357-78a5-4b4c-be3d-f9dee26d1a8e","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"85733c0a-07d8-47e9-8839-1739d66c8ffa","uri":"","name":"partnerresources.viator.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e4a1472e-fba0-4467-91ca-65d994f20782","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"607c7e18-aa58-44c1-a83f-cc3ed1b1337b","uri":"","name":"api.tapayments.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"402f7dbc-e033-4f20-8b87-28438b7ee976","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"8796cef7-190a-410a-b4b4-f21aabc5d902","uri":"","name":"*.rc.viatorinc.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"665bfdad-3d4d-40d3-a39b-7764405842a7","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"50c9f1cc-1e58-4049-9556-3de764ce6c31","code":"viator","state":"in_progress","endsAt":null,"bountyId":"032f9683-d3d4-4d55-90b7-f020704dc78e","startsAt":"2017-02-09T17:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Consumer Services","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/9ba4/5da2/66f7c128/2a4682465d62350d6b039c0f31279664_ViatorLogo.png","logoBackgroundColor":"#00759a","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2017-02-09T17:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/viator","changelogs":"/engagements/viator/changelog","submissions":null,"announcements":"/engagements/viator/announcements","hallOfFame":"/engagements/viator/hall_of_fames","crowdstream":"/engagements/viator/crowdstream"},"announcementsCount":22,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/viator/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=viator\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/viator/engagement_subscribers","engagementChangelogsUrl":"/engagements/viator/changelog","publishedAt":"2026-07-15T09:17:37.978Z","engagementChangelogUrl":"/engagements/viator/changelog/3d692266-89d0-42d6-a49b-1430f275ec8f","createUserFeedbacksUrl":"/engagements/viator/feedbacks","engagementCrowdstreamUrl":"/engagements/viator/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}