{"id":"5388d039-dc1b-45ee-94c0-820d7a100579","engagementId":"4830b30f-3b5c-43f1-bf9b-f736bf4904d6","data":{"brief":{"id":"edfe471a-c58e-4984-bbde-8d9d836e3321","name":"Webflow Vulnerability Disclosure Pro Engagement","tagline":"Webflow is the way to design, build, manage and optimize powerful websites visually. Please submit your findings to this Bug Bounty Program.","description":"\u003cp\u003eWelcome to the Webflow Vulnerability Disclosure Program (VDP) program!  At Webflow, our mission is to bring development superpowers to everyone. As the pioneer of the Website Experience Platform (WXP), we’re redefining how teams Build, Manage, and Optimize for the web — combining visual development, powerful content management systems, AI-driven personalization, seamless hosting, and end-to-end analytics in a single, unified platform. With AI at the core, Webflow helps teams move faster, create more performant digital experiences, and scale without heavy engineering support. From independent designers and creative agencies to global enterprises, hundreds of thousands of organizations use Webflow to turn ideas into reality — and to power what’s possible on the web.\u003c/p\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eNote: We do not allow public disclosures of reported findings at this time.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eGood luck, and happy hunting!\u003c/p\u003e","industryTagId":null,"targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Webflow not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Webflow, you can report it to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/home\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Portal\u003c/a\u003e. However, be aware that such reports will be ineligible for acceptance.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eAll targets are accessible via the public internet.\u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003e\u003cem\u003eNote: For this program, Webflow will not provide any discount coupons or test accounts for features behind the paywall.\u003c/em\u003e \u003c/p\u003e\n\n\u003cp\u003eAccounts on all publicly facing targets can be self-provisioned. Please sign up for an account using your @bugcrowdninja.com email address for testing of all features. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eWebflow Workspace and Site level roles and permissions can be found at \u003ccode\u003ehttps://university.webflow.com/lesson/workspace-roles-and-permissions\u003c/code\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003ccode\u003eWebflow Dashboard\u003c/code\u003e\n\n\u003cul\u003e\n\u003cli\u003eWebflow Dashboard is most of the authenticated part of the site apart from the designer. All APIs under \u003ccode\u003e/dashboard/*\u003c/code\u003e come under this category. Account, workspace and site settings can all be accessed from the dashboard. This is one of the most critical pieces of the Webflow app.\u003cbr\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003eWebflow Designer\u003c/code\u003e\n\n\u003cul\u003e\n\u003cli\u003eWebflow Designer allows a user to design and customize their site. Each site designer has a different subdomain under \u003ccode\u003e*.design.webflow.com\u003c/code\u003e. Vulnerabilities within a designer are generally contained to the subdomain unless chained with another vuln to impact Dashboard \u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003eWebflow Marketplace\u003c/code\u003e\n\n\u003cul\u003e\n\u003cli\u003eWebflow Marketplace is under \u003ccode\u003e/marketplace\u003c/code\u003e and lets users pick from a variety of templates, libraries and apps. Users can also connect with Webflow experts to help accelerate their site building. Marketplace also gives designers and 3rd party developers an option to monetize their creations under different categories. \u003c/li\u003e\n\u003cli\u003eA vulnerability within the marketplace resources that impacts all users is in scope, but creating a malicious template, library or app is not in scope. Similarly templates, libraries and apps created by external designers and developers are not in scope for this project, with the exception of the following 2 apps\n\n\u003cul\u003e\n\u003cli\u003eFigma to Webflow App \u003ccode\u003ehttps://webflow.com/apps/detail/figma-to-webflow\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003eHubSpot \u003ccode\u003ehttps://webflow.com/apps/detail/hubspot\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003eStripe \u003ccode\u003ehttps://webflow.com/apps/detail/stripe\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003eBynder \u003ccode\u003ehttps://webflow.com/apps/detail/bynder\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003eZapier \u003ccode\u003ehttps://webflow.com/apps/detail/zapier\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003eGoogle site tools for Webflow \u003ccode\u003ehttps://webflow.com/apps/detail/google-site-tools-for-webflow\u003c/code\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003eCode Generation\u003c/code\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003ca href=\"https://webflow.com/feature/code-gen\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eWebflow CodeGen\u003c/a\u003e allows users to generate production-grade apps and reusable components with AI that match their site brand, content, and design system. It includes App Gen for full-stack web apps and Component Gen for custom components built natively in Webflow.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003eAI Site Builder\u003c/code\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003ca href=\"https://webflow.com/ai-site-builder\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAI Site Builder\u003c/a\u003e includes AI-powered site building and related experiences that assist users in creating, structuring, or configuring Webflow sites and content.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003eAI Assistant\u003c/code\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003ca href=\"https://webflow.com/updates/webflow-ai-assistant\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAI Assistant\u003c/a\u003e includes conversational, embedded, or workflow-based AI features that help users interact with Webflow products, settings, content, or site-building functionality. \u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003eDeveloper APIs\u003c/code\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003ca href=\"https://developers.webflow.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eDeveloper APIs\u003c/a\u003e include Webflow Data APIs and Designer APIs exposed for programmatic access and integration use cases.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003eOptimize\u003c/code\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003ca href=\"https://webflow.com/feature/optimize\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eWebflow Optimize\u003c/a\u003e lets you run experiments, personalize for every visitor, and let AI deliver the winning experience.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003eAnalyze\u003c/code\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003ca href=\"https://webflow.com/feature/analyze\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eWebflow Analyze\u003c/a\u003e  puts a native, unified view of visitor behavior in your hands so you can make data-backed decisions that improve site performance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eKnowledge Base:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll of our publicly available documentation is available at: \u003ccode\u003ehttps://university.webflow.com\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003eWebflow Developer APIs can be found at: \u003ccode\u003ehttps://developers.webflow.com/\u003c/code\u003e while Designer APIs can be found at \u003ccode\u003ehttps://developers.webflow.com/designer/reference/introduction\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003eWebflow updates can be found at: \u003ccode\u003ehttps://webflow.com/updates\u003c/code\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExclusions:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe following submission types are excluded from our program:\n\n\u003cul\u003e\n\u003cli\u003eRate limiting/enumeration issues that only result in resource exhaustion or Denial of Service (DoS)\u003c/li\u003e\n\u003cli\u003eRate limited user enumeration\u003c/li\u003e\n\u003cli\u003eMissing security headers without a PoC demonstrating risk\u003c/li\u003e\n\u003cli\u003eSPF/DMARC issues without PoC of exploitability\u003c/li\u003e\n\u003cli\u003eSelf XSS or XSS that affects only out-of-date browsers\u003c/li\u003e\n\u003cli\u003eHost header injection without PoC to impact other users\u003c/li\u003e\n\u003cli\u003eAttacks that require social engineering or phishing of Webflow employees\u003c/li\u003e\n\u003cli\u003eOpen redirects that originate from non-webflow assets\u003c/li\u003e\n\u003cli\u003eSelf attacks or attacks that require access to user network and/or device\u003c/li\u003e\n\u003cli\u003eClickjacking without demonstrating risk\u003c/li\u003e\n\u003cli\u003eDisclosure of server information without any vulnerabilities in the server version\u003c/li\u003e\n\u003cli\u003eBlind SQLi attacks that just hang the connection. Webflow uses \u003ca href=\"https://en.wikipedia.org/wiki/Tarpit_(networking)\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003etarpitting\u003c/a\u003e, so connection delays are expected \u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003ePlease refrain from\n\n\u003cul\u003e\n\u003cli\u003eDenial of service (DoS)\u003c/li\u003e\n\u003cli\u003eSpamming through calls, emails, etc\u003c/li\u003e\n\u003cli\u003eSocial engineering (including phishing) of Webflow staff or contractors\u003c/li\u003e\n\u003cli\u003eAny physical attempts against Webflow property\u003c/li\u003e\n\u003cli\u003eSpamming our support or contact forms for testing\u003c/li\u003e\n\u003cli\u003eTesting customer sites built on Webflow\u003c/li\u003e\n\u003cli\u003eDisrupting Webflow’s services except as provided for in this program\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eCustomer data that is not under the target scope for the Webflow app\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eN-Day Policy:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eWhen a patch for N-Day bugs are made available to the public, , we will consider these N-Day bugs in scope 30 days after the patch was released\n\n\u003cul\u003e\n\u003cli\u003eFor example, an N-Day bug is released on 01/01/2025 without a patch, we would consider it in-scope 30 days after the patch is released\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (or similar laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms of Service that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRules and Restrictions:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou must comply with applicable laws at all times when participating in this program.\u003c/li\u003e\n\u003cli\u003eIn the event you access personal data, PII, or other sensitive data, you are required to follow all laws and regulations applicable to the access and processing of such personally identifiable information and/or data, such as the California Consumer Privacy Act of 2018 and the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679).\u003c/li\u003e\n\u003cli\u003eYou must not disclose or disseminate anyone’s personal data you discover as part of your participation in this bug bounty program.\u003c/li\u003e\n\u003cli\u003eIf a vulnerability provides unintended access to data, limit the amount of personal data you access to the minimum required for effectively demonstrating the vulnerability; cease testing, and submit a report immediately. Such data may include Personally Identifiable Information (PII), Personal Data, Personal Healthcare Information (PHI), confidential information, or any other similarly situated categories of data.\u003c/li\u003e\n\u003cli\u003eThis offer is void where prohibited by law.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"f1c8466a-9e46-4287-8a4e-971a5edf48a5","name":"In-Scope Targets","targets":[{"id":"5e036847-0088-4c58-9325-3b33d5623ce1","uri":"https://webflow.com","name":"Webflow ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b7f623df-8ecd-47b5-9cb9-b086dba93f15","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"5e036847-0088-4c58-9325-3b33d5623ce1"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"5e036847-0088-4c58-9325-3b33d5623ce1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5e036847-0088-4c58-9325-3b33d5623ce1"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"5e036847-0088-4c58-9325-3b33d5623ce1"}],"recentChangeFlags":null},{"id":"a685ba88-dbef-4628-ac5e-138a5350a4d4","uri":"https://webflow.com/dashboard","name":"Webflow Dashboard","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2ad145c3-6719-4185-9c6d-20aa9bc609f5","sortOrder":1},"sortOrder":1,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"a685ba88-dbef-4628-ac5e-138a5350a4d4"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"a685ba88-dbef-4628-ac5e-138a5350a4d4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a685ba88-dbef-4628-ac5e-138a5350a4d4"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"a685ba88-dbef-4628-ac5e-138a5350a4d4"}],"recentChangeFlags":null},{"id":"92f680fa-158e-4958-bb59-cb4f6860b136","uri":"","name":"*.design.webflow.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9d12ba43-bd4c-4bb1-9e47-5a98645f1100","sortOrder":2},"sortOrder":2,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"92f680fa-158e-4958-bb59-cb4f6860b136"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"92f680fa-158e-4958-bb59-cb4f6860b136"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"92f680fa-158e-4958-bb59-cb4f6860b136"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"92f680fa-158e-4958-bb59-cb4f6860b136"}],"recentChangeFlags":null},{"id":"e5da2443-eb85-4be6-a180-70e3893ca5c9","uri":null,"name":"api.webflow.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a08e7976-a1d0-4b8b-89e6-a86a55ecdca1","sortOrder":3},"sortOrder":3,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"e5da2443-eb85-4be6-a180-70e3893ca5c9"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"e5da2443-eb85-4be6-a180-70e3893ca5c9"}],"recentChangeFlags":null},{"id":"14a970c2-cb8a-48ad-9639-c84338b5afa5","uri":"","name":"auth.webflow.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"eb329d61-fc33-4560-b27b-eead071efa7d","sortOrder":4},"sortOrder":4,"tags":[{"id":"3ff3fda3-da69-45cc-9640-b57d3228af94","name":"OAuth","targetId":"14a970c2-cb8a-48ad-9639-c84338b5afa5"}],"recentChangeFlags":null},{"id":"45d34dff-0b17-4abb-b7fd-3272113e29b5","uri":"https://webflow.com/apps/detail/hubspot","name":"Webflow Marketplace App - HubSpot","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5c4dfdc6-d957-4913-8db3-b82a3048eae6","sortOrder":5},"sortOrder":5,"tags":[{"id":"3ff3fda3-da69-45cc-9640-b57d3228af94","name":"OAuth","targetId":"45d34dff-0b17-4abb-b7fd-3272113e29b5"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"45d34dff-0b17-4abb-b7fd-3272113e29b5"}],"recentChangeFlags":null},{"id":"cf3a7810-5cfb-4aac-bc7f-241265f09421","uri":"https://webflow.com/apps/detail/figma-to-webflow","name":"Webflow Marketplace App - Figma to Webflow","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"65e60648-d3c4-44e4-a454-3c07120dc3b4","sortOrder":6},"sortOrder":6,"tags":[{"id":"3ff3fda3-da69-45cc-9640-b57d3228af94","name":"OAuth","targetId":"cf3a7810-5cfb-4aac-bc7f-241265f09421"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"cf3a7810-5cfb-4aac-bc7f-241265f09421"}],"recentChangeFlags":null},{"id":"cd82e90a-f6f2-4cf6-8287-73a0d7e0b917","uri":"https://webflow.com/apps/detail/stripe","name":"Webflow Marketplace App - Stripe","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"30e233c9-5394-4490-b59b-69b4ac81ab9c","sortOrder":7},"sortOrder":7,"tags":[{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"cd82e90a-f6f2-4cf6-8287-73a0d7e0b917"}],"recentChangeFlags":null},{"id":"e61c61d5-4fe7-4ec8-a246-6937ac5e6a69","uri":"https://webflow.com/apps/detail/google-site-tools-for-webflow","name":"Webflow Marketplace App - Google site tool for Webflow","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4e7d74e3-9704-4628-80f3-49632c79b3d4","sortOrder":8},"sortOrder":8,"tags":[{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"e61c61d5-4fe7-4ec8-a246-6937ac5e6a69"}],"recentChangeFlags":null},{"id":"f5d0184d-d100-46e8-b515-6b98a88c8ab6","uri":"https://webflow.com/apps/detail/bynder","name":"Webflow Marketplace App - Bynder","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ad9da5cc-f436-4e55-a3b4-2bf31104f5a1","sortOrder":9},"sortOrder":9,"tags":[{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"f5d0184d-d100-46e8-b515-6b98a88c8ab6"}],"recentChangeFlags":null},{"id":"9d64f542-33b7-49d6-896a-430ee6116092","uri":"https://webflow.com/apps/detail/zapier","name":"Webflow Marketplace App - Zapier","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8159e3ad-a94d-4931-8fef-cc8ba2dd2f88","sortOrder":10},"sortOrder":10,"tags":[{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"9d64f542-33b7-49d6-896a-430ee6116092"}],"recentChangeFlags":null},{"id":"86bde04f-ada3-4ffb-8e1f-5a59e2ba1b24","uri":"","name":"app.intellimize.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4d978c0d-7e77-4802-b943-bad7a3b33c65","sortOrder":11},"sortOrder":11,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"86bde04f-ada3-4ffb-8e1f-5a59e2ba1b24"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"86bde04f-ada3-4ffb-8e1f-5a59e2ba1b24"}],"recentChangeFlags":null},{"id":"c77d6702-3439-4847-be34-ee5be82f4b50","uri":"","name":"api.intellimize.co","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3d1235a3-0f67-489c-8b8b-4bf1ad91b656","sortOrder":12},"sortOrder":12,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c77d6702-3439-4847-be34-ee5be82f4b50"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"c77d6702-3439-4847-be34-ee5be82f4b50"}],"recentChangeFlags":null},{"id":"6f32bff4-f516-4e57-bfb7-5d7ae1eeef49","uri":"","name":"log.intellimize.co","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b4721adb-37fa-4f64-b780-af9913eb949e","sortOrder":13},"sortOrder":13,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"6f32bff4-f516-4e57-bfb7-5d7ae1eeef49"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"6f32bff4-f516-4e57-bfb7-5d7ae1eeef49"}],"recentChangeFlags":null},{"id":"60c08745-a972-4cb9-b9c8-2fdeac848016","uri":null,"name":"forum.webflow.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"16b49e81-36fe-41c9-91cc-1a73da92a972","sortOrder":14},"sortOrder":14,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"60c08745-a972-4cb9-b9c8-2fdeac848016"}],"recentChangeFlags":null},{"id":"1f573bc4-c5bb-412d-bd4c-4d08f9a40994","uri":null,"name":"affiliates.webflow.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"74c0b86c-14ed-4463-90bf-116240ebdb6b","sortOrder":15},"sortOrder":15,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1f573bc4-c5bb-412d-bd4c-4d08f9a40994"}],"recentChangeFlags":null},{"id":"01462cb6-a5f6-44a8-aaac-35ada5f36881","uri":null,"name":"university.webflow.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"39c64722-65fa-437d-9101-b5434f3d49d9","sortOrder":16},"sortOrder":16,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"01462cb6-a5f6-44a8-aaac-35ada5f36881"}],"recentChangeFlags":null},{"id":"48b328cd-729d-480c-a902-b5cdd894cfc5","uri":"","name":"experts.webflow.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5c9671e0-a0b8-4cb3-98a0-2c5502babb1e","sortOrder":17},"sortOrder":17,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"48b328cd-729d-480c-a902-b5cdd894cfc5"}],"recentChangeFlags":null},{"id":"abaeb456-0cbb-46b3-825b-b8cf5b723671","uri":"https://webflow.com/community","name":"Webflow Community","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8d1d6f6b-d2c5-4dc9-8531-0c6b3cd269f2","sortOrder":18},"sortOrder":18,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"abaeb456-0cbb-46b3-825b-b8cf5b723671"}],"recentChangeFlags":null},{"id":"222b1355-475b-4414-a35a-38700c2a0a03","uri":"https://webflow.com/resources","name":"Webflow Resources","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c875750b-56cd-49f7-ae72-98f70b38e33f","sortOrder":19},"sortOrder":19,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"222b1355-475b-4414-a35a-38700c2a0a03"}],"recentChangeFlags":null},{"id":"dbb1d28f-a598-4718-b107-6059607c5993","uri":"https://webflow.com/blog","name":"Webflow Blog","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"85829fc4-3ec8-4ba0-8d91-aafc56b817c9","sortOrder":20},"sortOrder":20,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"dbb1d28f-a598-4718-b107-6059607c5993"}],"recentChangeFlags":null},{"id":"740b4746-6364-441d-88e7-3d0fa470fdc9","uri":"https://github.com/webflow","name":"Webflow Open Source","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f472fb02-881a-4afb-954f-bfe2c91b7044","sortOrder":21},"sortOrder":21,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eNote: No credits, discount codes or test accounts will be issued to test features behind the paywall.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eException:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eA vulnerability found in Webflow Designer generally has a lower impact than Webflow Dashboard due to the Designer being under a subdomain. For example, if a XSS bug qualifies as a P2 for Dashboard, it will qualify as P3 for Designer (unless you find a way to escape the designer and impact the Dashboard or are able to demonstrate elevated impact)\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"070334fc-79da-4904-bf51-0ee0c7beddc9","name":"Out of Scope","targets":[{"id":"f9b22224-7165-4aaa-bf7f-1320a66010e1","uri":"","name":"webflowconf.webflow.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"289c9f68-8c40-4a4f-aebf-010e22a15215","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c5207c6e-736a-469d-ac7a-5d13d773dbb9","uri":"","name":"*.webflow.io","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9f90ae9f-e2dd-482a-a187-787c1ff07955","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"b61d1cac-3a8a-4d75-8f6a-407eedac304b","uri":"","name":"discourse.webflow.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"676f8004-aae5-434c-8208-7ee6efaf0982","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b61d1cac-3a8a-4d75-8f6a-407eedac304b"}],"recentChangeFlags":null},{"id":"7c638dbf-a7f3-4236-a286-8e32e3ebd594","uri":"","name":"Webflow Development Environments ","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"26a8e764-db92-4178-b6f2-2bb48a1a276f","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"941e7584-bd78-4d86-8dbf-a0a279f1f6a8","uri":null,"name":"wishlist.webflow.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"82951f5c-9ab8-47c9-8f30-588987296028","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"941e7584-bd78-4d86-8dbf-a0a279f1f6a8"}],"recentChangeFlags":null},{"id":"45e98b91-631d-4a05-8667-16ec8b6b46d2","uri":"https://community.webflow.com","name":"community.webflow.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"014e4f97-21de-44b7-95fc-951e51c589bb","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"4830b30f-3b5c-43f1-bf9b-f736bf4904d6","code":"webflow-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"d88650b8-11fc-47b6-82b5-195b1a3ecaf4","startsAt":"2025-07-01T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":null,"methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/ae69/7d52/d594f00a/3d060b3b01236a4dba1f8ef3dbe1280a_webflow_inc__logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-07-01T18:00:00.278Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/webflow-vdp-pro","changelogs":"/engagements/webflow-vdp-pro/changelog","submissions":null,"announcements":"/engagements/webflow-vdp-pro/announcements","hallOfFame":"/engagements/webflow-vdp-pro/hall_of_fames","crowdstream":"/engagements/webflow-vdp-pro/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/webflow-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=webflow-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/webflow-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/webflow-vdp-pro/changelog","publishedAt":"2026-08-14T19:40:18.304Z","engagementChangelogUrl":"/engagements/webflow-vdp-pro/changelog/5388d039-dc1b-45ee-94c0-820d7a100579","createUserFeedbacksUrl":"/engagements/webflow-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/webflow-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}