{"id":"5fee854c-9a3b-4bc5-8cef-6ea8a612866f","engagementId":"9ca5c1cf-6a5d-4e59-92f8-f33f06ddd381","data":{"brief":{"id":"24b53828-0343-4f0a-870e-8a9a1f462fc9","name":"Victoria's Secret Vulnerability Disclosure Engagement ","tagline":"An iconic specialty retail brand, Victoria’s Secret needs no introduction. Our name is synonymous with all things feminine.","description":"\u003cp\u003eVictoria's Secret takes its responsibility to protect customer experiences seriously, and we believe that working with skilled security researchers across the globe is a critical component to our process.  We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web apps. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Victoria's Secret not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before submitting.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess/Credentials\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eTarget is accessible via public internet. Sign up using your @bugcrowdninja.com email only. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eClickjacking on non-sensitive pages\u003c/li\u003e\n\u003cli\u003eAttacks requiring MITM or physical access to a user's device\u003c/li\u003e\n\u003cli\u003eAny activity that could lead to the disruption of our service (DoS)\u003c/li\u003e\n\u003cli\u003eMissing best practices in Content Security Policy\u003c/li\u003e\n\u003cli\u003eResults from automated tools without any manual confirmation\u003c/li\u003e\n\u003cli\u003eLogin/Logout CSRF\u003c/li\u003e\n\u003cli\u003eLack of Secure/HTTPOnly flags on non-sensitive Cookies\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support \u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"49c73df6-dc5c-40d1-878a-abd3852eb8ec","name":"In Scope Targets","targets":[{"id":"74281e99-16bd-4094-b5d1-a50f3c91bb09","uri":"https://www.victoriassecret.com/us/","name":"victoriassecret.com/us","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e2db2fa8-785d-4117-9219-9abcfb93a53b","sortOrder":0},"sortOrder":0,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"74281e99-16bd-4094-b5d1-a50f3c91bb09"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"74281e99-16bd-4094-b5d1-a50f3c91bb09"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"74281e99-16bd-4094-b5d1-a50f3c91bb09"}],"recentChangeFlags":null},{"id":"007771ed-6b58-4427-87a2-50f0e2843221","uri":"https://apps.apple.com/us/app/pink-nation/id463630399","name":"Pink Nation iOS app","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"290f16e8-65d1-4e25-a13e-fca2a1813a40","sortOrder":1},"sortOrder":1,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"007771ed-6b58-4427-87a2-50f0e2843221"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"007771ed-6b58-4427-87a2-50f0e2843221"}],"recentChangeFlags":null},{"id":"9ebb9c96-ab85-4013-8ba6-8d209f4004f9","uri":"https://play.google.com/store/apps/details?id=com.victoriassecret.pinknation","name":"Pink Nation Android app","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"38e5d135-ebaf-4a3d-993f-eafe0e13568e","sortOrder":2},"sortOrder":2,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"9ebb9c96-ab85-4013-8ba6-8d209f4004f9"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"9ebb9c96-ab85-4013-8ba6-8d209f4004f9"}],"recentChangeFlags":null},{"id":"c2d1b1f1-4530-48bf-9e37-55898da991e7","uri":"https://apps.apple.com/us/app/victorias-secret/id336860594","name":"Victoria's Secret iOS app","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ff81c187-6f9a-4a5a-9991-e7ee4ab1910d","sortOrder":3},"sortOrder":3,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"c2d1b1f1-4530-48bf-9e37-55898da991e7"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"c2d1b1f1-4530-48bf-9e37-55898da991e7"}],"recentChangeFlags":null},{"id":"8940d3d2-0cf2-4de5-bf36-01b9bc79c614","uri":"https://play.google.com/store/apps/details?id=com.victoriassecret.vsaa","name":"Victoria's Secret Android app","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b953715d-6e3b-4fe4-acc5-095a8287d197","sortOrder":4},"sortOrder":4,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"8940d3d2-0cf2-4de5-bf36-01b9bc79c614"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"8940d3d2-0cf2-4de5-bf36-01b9bc79c614"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eNew features Added!\u003c/h2\u003e\n\n\u003cp\u003eNew updates added to https://www.victoriassecret.com\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003e- Create Account using SMS OTP (Web \u0026amp; Mobile App)\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eWe have changed the way login flow works in both web and mobile apps.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003e- Self-Verify (Web Only)\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eWe have updated the process of verification of user account.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003e- Sign‑in using SMS OTP (Web \u0026amp; Mobile App)\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eWe have added additional security for the login flow.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003e- AI PDP Assistant (Product Description Page)\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eWe have updated the product description page.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"9ca5c1cf-6a5d-4e59-92f8-f33f06ddd381","code":"victoriassecret-vdp","state":"in_progress","endsAt":null,"bountyId":"3316dc0e-3627-4bf0-a082-85835974c536","startsAt":"2021-04-13T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/bcaa/ea62/8dc521e8/b116853e91781ff9f569a776d71d171e_VS_Logo.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2021-04-13T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/victoriassecret-vdp","changelogs":"/engagements/victoriassecret-vdp/changelog","submissions":null,"announcements":"/engagements/victoriassecret-vdp/announcements","hallOfFame":"/engagements/victoriassecret-vdp/hall_of_fames","crowdstream":"/engagements/victoriassecret-vdp/crowdstream"},"announcementsCount":4,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/victoriassecret-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=victoriassecret-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/victoriassecret-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/victoriassecret-vdp/changelog","publishedAt":"2026-05-13T13:21:35.595Z","engagementChangelogUrl":"/engagements/victoriassecret-vdp/changelog/5fee854c-9a3b-4bc5-8cef-6ea8a612866f","createUserFeedbacksUrl":"/engagements/victoriassecret-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/victoriassecret-vdp/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}