{"id":"edde608a-a322-431d-8908-025b05972edb","engagementId":"dda9adcd-cf20-4b48-96fc-a1ec2275f02e","data":{"brief":{"id":"f4b4622e-965e-4a75-86e4-af33c6584b26","name":"Wyze Bug Bounty","tagline":"Bug Bounty","description":"\u003cp\u003eNo technology is perfect and Wyze believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web app and API. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"d7a636ff-c862-4101-a74f-f556036a5772","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Wyze not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Wyze, you can report it to wyzevpd@submit.bugcrowd.com. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eWyze products/devices may share the same source code and features if a vulnerability is found in one of them and the same issue is reported in another device that shares this code it will count as only one valid finding and will be flagged as a duplicate.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eTargets are accessible via public internet, please note that before reaching \u003ca href=\"https://auth.wyze.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://auth.wyze.com/\u003c/a\u003e you need to sign up for Wyze account, please click \u003ca href=\"https://auth.wyze.com/registration\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e \u003c/p\u003e\n\n\u003cp\u003eYou are testing on production. Behavior that compromises the stability and integrity of the site is out of scope. For example, do not target other user's data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it.\u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. To sign up for Wyze account, please click \u003ca href=\"https://auth.wyze.com/registration\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e \u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eWyze Cam V3\u003c/li\u003e\n\u003cli\u003eWyze Cam V4\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDoS Attacks\u003c/li\u003e\n\u003cli\u003eBrute Force Attacks \u003c/li\u003e\n\u003cli\u003eAnything not mentioned in scope will be considered out of scope\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Supoort\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":null,"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"885d325e-dcef-442e-9809-d6d2af66bf33","name":"In Scope Targets","targets":[{"id":"b8a8bb8d-b904-45e1-b24a-719ca063f98a","uri":"https://auth.wyze.com","name":"https://auth.wyze.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cc36f80b-d282-4f12-99ab-50214147dca3","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"b8a8bb8d-b904-45e1-b24a-719ca063f98a"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"b8a8bb8d-b904-45e1-b24a-719ca063f98a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b8a8bb8d-b904-45e1-b24a-719ca063f98a"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"b8a8bb8d-b904-45e1-b24a-719ca063f98a"}],"recentChangeFlags":null},{"id":"7d02385f-b039-446f-bc18-8703ea82e992","uri":"https://my.wyze.com","name":"https://my.wyze.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"16454a97-1e44-40c0-bf52-ef0b411a231f","sortOrder":0},"sortOrder":0,"tags":[{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"7d02385f-b039-446f-bc18-8703ea82e992"}],"recentChangeFlags":null},{"id":"5450c212-50e5-4c97-91c0-2e13c593b56f","uri":"https://api.wyzecam.com","name":"https://api.wyzecam.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c7574d19-0f65-487d-898a-5c6ac0745571","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"5450c212-50e5-4c97-91c0-2e13c593b56f"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"5450c212-50e5-4c97-91c0-2e13c593b56f"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"6833c05f-6dbf-4db5-a83c-cba235967da3","p1MaxCents":500000,"p1MinCents":300000,"p2MaxCents":160000,"p2MinCents":120000,"p3MaxCents":80000,"p3MinCents":50000,"p4MaxCents":40000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":1000000},"descriptionHtml":null,"rewardRangeData":{"1":{"min":3000,"max":5000},"2":{"min":1200,"max":1600},"3":{"min":500,"max":800},"4":{"min":50,"max":400},"5":{"min":null,"max":null},"programMax":10000},"recentChangeFlags":null},{"id":"ac5e279d-e715-4d3d-9ebd-b0c7afaee41f","name":"In Scope Targets 2","targets":[{"id":"a6eec724-322c-42f3-9f4b-19bdf8a21723","uri":null,"name":"Wyze Cam V3","category":"hardware","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2894df72-44b0-4a2f-84c1-4da581187900","sortOrder":0},"sortOrder":0,"tags":[{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"a6eec724-322c-42f3-9f4b-19bdf8a21723"}],"recentChangeFlags":null},{"id":"2fac6c10-90be-4de7-988a-aa4ed133ba8a","uri":"https://www.wyze.com/products/wyze-cam","name":"Wyze Cam v4","category":"hardware","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9ccaa2bc-2c74-4f2d-869c-cfbd6d6f13b7","sortOrder":1},"sortOrder":1,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"2fac6c10-90be-4de7-988a-aa4ed133ba8a"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"2fac6c10-90be-4de7-988a-aa4ed133ba8a"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"1d931961-b658-45b6-a1ec-90c2d136be78","p1MaxCents":200000,"p1MinCents":100000,"p2MaxCents":90000,"p2MinCents":50000,"p3MaxCents":40000,"p3MinCents":25000,"p4MaxCents":20000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1000,"max":2000},"2":{"min":500,"max":900},"3":{"min":250,"max":400},"4":{"min":50,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"dda9adcd-cf20-4b48-96fc-a1ec2275f02e","code":"wyze","state":"in_progress","endsAt":null,"bountyId":"bbbf8823-e59a-42ff-b64d-5d8c46e0a4f1","startsAt":"2022-07-14T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Electronics","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/86fc/b575/3016dede/258687babc6955e0a264cb79abd87db3_gnbn53nh.jpeg","logoBackgroundColor":"#000000","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2022-07-14T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/wyze","changelogs":"/engagements/wyze/changelog","submissions":null,"announcements":"/engagements/wyze/announcements","hallOfFame":"/engagements/wyze/hall_of_fames","crowdstream":"/engagements/wyze/crowdstream"},"announcementsCount":2,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/wyze/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=wyze\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/wyze/engagement_subscribers","engagementChangelogsUrl":"/engagements/wyze/changelog","publishedAt":"2026-09-24T16:46:53.166Z","engagementChangelogUrl":"/engagements/wyze/changelog/edde608a-a322-431d-8908-025b05972edb","createUserFeedbacksUrl":"/engagements/wyze/feedbacks","engagementCrowdstreamUrl":"/engagements/wyze/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}