{"id":"2a28998a-a3f5-4251-a7d6-cf3f735bb705","engagementId":"f89b01f6-4e23-4e00-9826-f2536d863baf","data":{"brief":{"id":"902ba812-1f7b-4d1c-af3d-83c12f0ed53a","name":"Xfinity Home \u0026 xFi","tagline":"Xfinity Home gives you peace of mind with a total home security and automation solution. With Xfinity xFi, you can personalize and control your home WiFi network. Together, they provide an in-home experience that is simple, easy, and awesome.","description":"\u003ch1\u003eProgram Overview\u003c/h1\u003e\n\n\u003cp\u003eAt Comcast, we’re committed to working alongside the security research community, and know we’re at our best when we continually enhance this process. That's why we’ve launched Xfinity Home’s bug bounty and expanded the scope to include \u003ca href=\"https://www.xfinity.com/support/articles/xfi-app-and-portal\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eXfinity xFi\u003c/a\u003e. With your help, we continue with our mission to make Xfinity products more secure.\u003c/p\u003e\n\n\u003ch5\u003eWhat is Xfinity Home?\u003c/h5\u003e\n\n\u003cp\u003eXfinity Home is a total home security solution that includes professional monitoring and advanced technology, all installed by experts and powered by WiFi from Xfinity.\u003c/p\u003e\n\n\u003ch5\u003eWhat is xFi?\u003c/h5\u003e\n\n\u003cp\u003eXfinity xFi lets you manage your home WiFi network and connected home. You can self-install and set up your WiFi environment in minutes, find your WiFi password, know who's online, view camera video, troubleshoot issues and manage family members' online experiences with features like Pause and Parental Controls. xFi Advanced Security helps keep you safe on sites people visit, prevent remote access from unknown sources, and report/block suspicious device activity with real-time app notifications.\u003c/p\u003e\n\n\u003cp\u003ePlease note, this program is specifically scoped for Xfinity Home and Xfinity xFi. If you believe you've found a security issue related to any other product or service(or are unsure) please report through our \u003ca href=\"https://bugcrowd.com/comcastvdp\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003evulnerability disclosure program\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eRatings/Rewards\u003c/h1\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, in some cases, a vulnerability priority will be modified due to its attack complexity, requirements, likelihood, or impact of successful exploitation. \u003c/p\u003e\n\n\u003cp\u003eAll submissions are reviewed to determine an accurate priority and any change will result in a detailed explanation provided to the researcher with the opportunity for a follow up.\u003c/p\u003e\n\n\u003cp\u003eRewards are determined through an internal impact assessment, researcher interaction and the overall quality, content, and accuracy of the report\u003c/p\u003e\n\n\u003ch2\u003eReward Guidelines\u003c/h2\u003e\n\n\u003cp\u003eRewards are determined through an internal impact assessment, researcher interaction and the overall quality, content, and accuracy of the report. \u003c/p\u003e\n\n\u003ch2\u003eHigh impact findings\u003c/h2\u003e\n\n\u003cp\u003eComcast may reward eligible P1 submissions up to \u003cstrong\u003e$10,000\u003c/strong\u003e for findings related to:\u003c/p\u003e\n\n\u003ch3\u003eXfinity Home\u003c/h3\u003e\n\n\u003col\u003e\n\u003cli\u003e\n\u003cp\u003eRemote unauthorized access (via publicly accessible internet, not on the same LAN/wireless network) of:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCloud storage videos\u003c/li\u003e\n\u003cli\u003eLive camera feeds\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eBypassing Armed Systems\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eAbuse/Theft of Service\u003c/p\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003ch3\u003eXfinity xFi\u003c/h3\u003e\n\n\u003col\u003e\n\u003cli\u003e\u003cp\u003eAbuse/Theft of Service\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eUnauthorized access to WiFi credentials\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eUnauthorized access to Profile’s Active Time\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eUnauthorized access to Advanced Security settings or alerts\u003c/p\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003ch3\u003eVRT Amendments\u003c/h3\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eVRT Name\u003c/th\u003e\n\u003cth\u003eAdjusted Priority\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eHigh Impact Subdomain Takeover\u003c/td\u003e\n\u003ctd\u003eP2 -\u0026gt; P3\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBasic Subdomain Takeover\u003c/td\u003e\n\u003ctd\u003eP3 -\u0026gt; P4\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eWe welcome reports of XSS arising from Swagger-UI but regret to inform you that they do not qualify for a bounty. Such instances will be categorized as P5 Informational.\u003c/p\u003e","industryTagId":"2b678620-ffdb-439a-8bac-c91b0087e0a0","targetsOverview":"\u003ch3\u003eExclusions\u003c/h3\u003e\n\n\u003cp\u003eThe following assets are not yet eligible for bounty and should be reported through our \u003ca href=\"https://bugcrowd.com/comcastvdp\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003evulnerability disclosure program\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch2\u003eTarget Info\u003c/h2\u003e\n\n\u003cp\u003eAll submissions must have demonstrable impact on the Xfinity Home or xFi. \u003cstrong\u003eTo be able to test comprehensively, researchers must be a current Xfinity subscriber.\u003c/strong\u003e Without an active Xfinity account, the available attack surface is highly limited - however, we encourage researchers to test with what is available to them.\u003cbr\u003e\n​\u003c/p\u003e\n\n\u003ch2\u003eEndpoint Details\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eAll Comcast/Xfinity endpoints called by Xfinity Home/xFi applications are in-scope.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eCustom User-Agent Header\u003c/h2\u003e\n\n\u003cp\u003ePlease add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior:\u003c/p\u003e\n\n\u003cp\u003eX-Bug-Bounty:\u0026lt;bugcrowdusername\u0026gt;\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eXfinity Home\u003c/th\u003e\n\u003cth\u003eDescription\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003exhomeapi-*.codebig2.net\u003c/td\u003e\n\u003ctd\u003eAPI Gateway\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003exhomeapi-*.cloud.comcast.net\u003c/td\u003e\n\u003ctd\u003eAPI for fetching device information\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e*-cvr-aws-*.sys.comcast.net\u003c/td\u003e\n\u003ctd\u003eEndpoints for CVR data\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e*signalservice.comcast.net\u003c/td\u003e\n\u003ctd\u003eEndpoint for live video\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eoauth.xfinity.com\u003c/td\u003e\n\u003ctd\u003eUser Authentication\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eapi.sc.xfinity.com\u003c/td\u003e\n\u003ctd\u003eAPI for retrieving user information\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003e​\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eXfinity xFi\u003c/th\u003e\n\u003cth\u003eDescription\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003einternet.xfinity.com\u003c/td\u003e\n\u003ctd\u003eWebsite for xFi functionality\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003esiorc.xfinity.com\u003c/td\u003e\n\u003ctd\u003eEndpoint for mobile app orchestration\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003espeedtest.xfinity.com\u003c/td\u003e\n\u003ctd\u003eUsed to determine Internet speed connection\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eorc-xfi.com\u003c/td\u003e\n\u003ctd\u003exFi orchestration layer\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003esmartinet.xfinity.com\u003c/td\u003e\n\u003ctd\u003exFi orchestration layer\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003e​\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eXfinity Home Hardware/IoT\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eTouchscreen Controller\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eWindows/Door Sensors\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eWireless keypad\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eWireless motion sensors\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eXfinity Home Cameras\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eXfinity xFi Hardware\u003c/th\u003e\n\u003cth\u003eType\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003exFi Gateways (e.g., XB3, XB6, XB7)\u003c/td\u003e\n\u003ctd\u003eHardware\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003exFi Pods\u003c/td\u003e\n\u003ctd\u003eHardware\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ch3\u003eOut of Scope\u003c/h3\u003e\n\n\u003cp\u003eAny domain/property of Comcast not listed in the targets section is out of scope for this bounty program. This includes any/all subdomains not listed above. If you believe you've identified a Comcast vulnerability on a system outside the scope of this program, please report it through our \u003ca href=\"https://bugcrowd.com/comcastvdp\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003evulnerability disclosure program\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eThe following is also out of scope of testing:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCOPS Monitoring Solutions\u003c/li\u003e\n\u003cli\u003eLoad Testing (DoS, DDoS, wireless jamming, etc.)\u003c/li\u003e\n\u003cli\u003eEmail spoofing issues (e.g., SPF, DKIM, DMARC)\u003c/li\u003e\n\u003cli\u003eAutomated scan reports without valid proof of concept\u003c/li\u003e\n\u003cli\u003ePhysical tampering of the device (I/O devices such as USB, SIM, and SD card slots are in scope)\u003c/li\u003e\n\u003cli\u003eSubmissions that require an attacker to physically open the case, including removing screws or breaking plastic casing (open chassis) to gain access to the internal hardware of a device.\u003c/li\u003e\n\u003cli\u003eVulnerabilities in pre-release product versions (e.g., Beta, Release candidate).\u003c/li\u003e\n\u003cli\u003eVulnerabilities in product versions no longer under active support.\u003c/li\u003e\n\u003cli\u003eVulnerabilities already known to Comcast. However, if you are the first external security researcher to identify and report a previously known vulnerability, you may still be eligible for a bounty award.\u003c/li\u003e\n\u003cli\u003eSubmissions that utilize third party websites or tools for cracking or validating secrets, passwords, keys or tokens.\u003c/li\u003e\n\u003cli\u003e3rd party integration \n\n\u003cul\u003e\n\u003cli\u003eFor a running list, please refer to our Works with Xfinity page.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e3rd party Marketing/Analytics endpoints\u003c/li\u003e\n\u003cli\u003eReports requiring a rooted/jailbroken device\u003c/li\u003e\n\u003cli\u003eDuplicate/known submissions\u003c/li\u003e\n\u003cli\u003eSocial engineering attacks\u003c/li\u003e\n\u003cli\u003eTheoretical security issues\u003c/li\u003e\n\u003cli\u003eProtocol-specific flaws \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eRules\u003c/h3\u003e\n\n\u003cp\u003eResearchers must have explicit permission from the account owner to perform any form of security testing.\u003cbr\u003e\n​\u003cbr\u003e\nNote: This program adheres to Bugcrowd's \u003ca href=\"https://researcherdocs.bugcrowd.com/docs/disclosure\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecoordinated disclosure terms\u003c/a\u003e. We ask that you provide us a copy of your disclosure report prior to publication and do not publicly report findings until they been fully remediated.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eIf you believe a vulnerability is particularly sensitive, you may use our PGP key to encrypt your report. \u003c/p\u003e\n\n\u003ch3\u003ePGP Key:\u003c/h3\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre class=\"highlight plaintext\"\u003e\u003ccode\u003e-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBGBeISUBEAC0HSrden41OvU/JV6TbyZ0vCrQrx2keOsCeX0I524BrQbQP/3d\nYLfDCZjaq0U2ZLwV+A/Mu8O+LEqKffOqyBEVCUVyh1Zjkmkp+Jk/FomaEwGj2KYD\nG5iyw0j+Cuu9S1HMrKozOJCGuJ3Aq9qn38n8vLy3spsnCIiKQpJMnYBAzKwDLuO+\n2JrQ7vpZ2ytW63mLcouQ9cKmA4W5OlD6gm7Fd63KYF7g+toxHw22ZXDT01fqAA9n\nzIOyoLZQcLMXAfddQuRklji65/cGhtPIVsBs2ZV9xJnn50VVvfc14P22nK9bZgf0\nXoeBAL8LB+f7VIVTD/+X5ToA1BiFATbivxX3dZZwzGBMxROyFpMU2RCXwZj0NItj\n/YfO4DnG2K77WF9XKpeqt+D/KaV9WXd91GxTJgbjY7GRsGPEjLyGqAAZAvmBdO1p\n+Bc2cxIiQ9yhceVfreUOdNPwp5O1p9Z8NN48cM6J1mrm4473OqIm71BoWaoh2+wn\nUpwPtvQ95ZFSrPrDa9MNRieGB4/zGQkDCQegOFFD1uVF477ft8I0tNUaSc/Ixwpp\nGj9ijY69Ra4I66CJGtGQ79VZ1xpML8RVROTKdbh9hvqBS1/pJiGBUtiPNg5iubvS\nPwmLcwowA6nRU3EYj+jMmje1pEHmcgcu7oMzaWH93EdFEzl1Av4kjnC4jwARAQAB\ntF1Db21jYXN0IFByb2R1Y3QgU2VjdXJpdHkgSW5jaWRlbnQgUmVzcG9uc2UgVGVh\nbSAoUFNJUlQpIDxzZWN1cml0eWRlZmVjdHJlcG9ydGluZ0Bjb21jYXN0LmNvbT6J\nAk4EEwEIADgWIQQ/lltQ7aGclNQZCAinTPOe0kWI8gUCYF4hJQIbAwULCQgHAgYV\nCgkICwIEFgIDAQIeAQIXgAAKCRCnTPOe0kWI8uIOD/sHfn9sMRQYlzcCntyXA/jy\nmgkh2IdwNxOw5wG48m771AR1VFNr54dY3AgK74xPcFsiT6FUyMKrp72weyv/7/BW\nvOh3M2ff9VaZjWeN/L96I3mfHkzoyQ19vDhtc9MtXnZrybV8SvWFyOO0Ziu6gNSl\nygBo4GjBIkAL32uRmqcyoUZTJJdDpLAM/m76lodEQ/ekC5JmJADOdK+BmVh4rJ4H\nbx8Uu+SseTQ0XjccqKYu+T4OxtgqmCLc2gvLpJH72XWDU0iKOyFW1BL4rqh2RTCj\nrn5xEYm3RBVfHjN+z/REuyNwcxcR0dqk5h9903XsYELIQO/tHyBRGxX3HKs+R0Sk\nGYLe/scyoETE91DnZSPrt3c3SrwOur5E8V0yNhGbADYwD6CVVPvIZcdUjusXFdjD\nKT/JfSU6MCqAD70CwBTIUcEobw22C0sGQuEO5ayC3EtdbYvcoAMKU1+TyYzJFPif\nGeQ+KU1Q94Mnc3uh9/nTL+w54IcYm4SzkTGOYqTQPYgdnlkV+kx14iBLfI54QmZS\nYrfY1cqb564W8bDtis9JLRm3yJ2a2q8bCadkuSGpJ3dM6cAYXtTSQeSTiWt3L3Ri\nAu6i2iimUF+TxMfIxUdwRsApTOBBGIDY4EPzWSFH8+Cb3SXYBAm6Bv5KXSplnEbg\nv5z7jnChE2TtUDQ6LM7bF7kCDQRgXiElARAAuPg110eFje7iJ+CWF3YPYlWydzt4\n3syp0tzD+FNx22eiFxJufLONxSLBjpyFcRxixsQtGF1DV/88Ois1brDBkp7kAdpd\nX1c+ESBmqOXTsSy6/YCeD9kChzViS6T+9qUbJLLPG0GFclOrheLumh1RrrO5XRQd\nj+xcF0g/3oYZrWwUFfGHg0RxFp2zi+GODK5Ab7CSsDUkZxDCbGY608Mv/hy3W5GP\npIty+B/i+J4OZJ4FCzgN8jCHNMftI1vMmWFbO4dljWboDf1rNxrbYSdMTCIaSYbi\nGp+K+iucGabhDjo6mCAcjMM9wn/Mo+E/WeRrqHQmYqrSMfrCU/9xZHsbMlIkK+Xj\nCceWmUSNMVhm22qxn6AlQUI9h2jYV4wyYw4uD4vEnkUZiGM//DWCMX6YNNFfU6f/\n4YhIuctq7cv4RHWLW3/c1zHJsNq8r6uaTdYEtYBYWQvYvNj9/aNkuDnjA/TMHEH/\namND500m8HOEs7X6nHLsai/9ZpxUuAlgq+4UVKOX+qG5P+SDbeSUJEqBaCfbC8zE\nSQ5ngSro5et+bOsiC59JfwA/iRlSL5IfJpThIHMoI7SPWvwlQxBwLlfkiDBv0k0e\nw5uw07VDc32WVWg9OIMMwUL5NeMoX535Y6WEZYDPRSTMVy3doUcze+bdWnwzPLbd\ne/DyWjjHzoCwh00AEQEAAYkCNgQYAQgAIBYhBD+WW1DtoZyU1BkICKdM857SRYjy\nBQJgXiElAhsMAAoJEKdM857SRYjy/ZcP/AgQ611ciptmamHlYcwq3EsRTa050UN/\n9/Tw8KzPG5zRIrfgfJKJ90GMOtrAxGCj4Ysbm+oJpRB+M59TOBI+aFw+k4TO4LCq\noaFPPHwLN9pg0Rg5nYnqm0rzCQHYC5iZYbTGnb5GxBW5wLCe+WtkUVLnoEShNEJU\n+Atqs5V34ZmpfzsEqCRlg9vJhodnpwZpYv5iGlqSEL4llfgRfga5P9VKBwjPCklx\nA3A6AXOxXDj1g1mR5DDOfE74aOIS6sB+jN7Fe4wBdF+SCgtuiOk0fr+D8xbMkGRy\nOrsUZZLnu534YreoUGxFnPp4svNp7HFnb1qCUnNdnDwPyeNsL1TKN3C6dqieNlbw\nog60fXUIZ5knYHiHm5BSEfzgVoHrykzq9DUT/fa9xLAxP381chLGTU9jSRDPIPeY\n7YuLDh0pgCqoqQO/QkzsJPE8JyBke7iLFviczlhh31nH9V4dn23c3G5EWgyL3n5u\nS2lEuH14ieCh3Ql4lKD/hNhYEr3DTvrM3OKOgsGFKB+KMmorsT9ePWs2J6gA4dMA\nMQbCp6sSvxSM/lGKCZSgyRsuuWoWKRTqT7MhIhmea3AbyG5rzqLqw+aMGRiY3Uuc\n6OwtW8m2ieGl4AyTUvfsIg+iE+al8FXAEFoN2rxtUFZvc8elpvSe6qkLxEAaSt3O\ng6h+SklSCYsx\n=Lfos\n-----END PGP PUBLIC KEY BLOCK-----\n\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\n\u003ch3\u003eSafe Harbor:\u003c/h3\u003e\n\n\u003cp\u003eWe consider activities conducted consistent with any of the terms (the \"Terms\") of the Xfinity Home/xFi bug bounty program described on this page (the \"Bug Bounty Program\") to constitute “authorized” access under applicable anti-hacking laws. To the extent your activities are inconsistent with restrictions in our applicable terms and conditions governing use of our services, we waive those restrictions solely for the limited purpose of permitting security research under the Bug Bounty Program. We will not bring a claim against you for circumventing the technological measures we have used to protect the applications in scope provided such circumvention is conducted in the context of good faith security research in accordance with the Terms. We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of the Terms. For this safe harbor to be effective, researchers must comply with all applicable laws, and not disrupt or compromise any data beyond what this Bug Bounty Program permits.\u003c/p\u003e\n\n\u003cp\u003ePlease understand that if your security research involves the networks, systems, information, applications, products, or services of a third party (which is not us), we cannot bind that third party, and they may pursue legal action or give notice law enforcement. We cannot and do not authorize security research in the name of other entities, and cannot in any way offer to defend, indemnify, or otherwise protect you from any third-party action based on your actions. If legal action is initiated by a third party against you and you have complied with the Terms, upon being made aware of the foregoing, we may take steps to make it known that your actions were conducted in compliance with our policies. \u003c/p\u003e\n\n\u003cp\u003ePlease submit a report to us before engaging in conduct that may be inconsistent with or unaddressed by the Terms.\u003c/p\u003e\n\n\u003cp\u003eNote: This program adheres to Bugcrowd's coordinated disclosure terms. We ask that you provide us a copy of your disclosure report prior to publication and do not publicly report findings until they been fully remediated.\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"641f0090-180b-4b83-970f-71a9351ba784","name":"███████████████","targets":[{"id":"35e5c5d6-af18-4ffd-a265-733960d3a1f9","uri":null,"name":"████████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5243f29f-8500-4dc8-9b03-d7bf26e26232","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"35e5c5d6-af18-4ffd-a265-733960d3a1f9"}],"recentChangeFlags":null},{"id":"9c822da7-1898-4b40-9412-3ea04b010693","uri":null,"name":"████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"17422d6a-14c0-4149-b6e4-38abae62d652","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"9c822da7-1898-4b40-9412-3ea04b010693"},{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"9c822da7-1898-4b40-9412-3ea04b010693"},{"id":"4e683276-8d35-4745-9a7c-8172f1c8fd9e","name":"Radiofrequency Testing","targetId":"9c822da7-1898-4b40-9412-3ea04b010693"},{"id":"9b8c3b7f-9a97-484b-94a0-b0f775144784","name":"WiFi","targetId":"9c822da7-1898-4b40-9412-3ea04b010693"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"9c822da7-1898-4b40-9412-3ea04b010693"}],"recentChangeFlags":null},{"id":"62b8f623-e9fc-487f-9945-60328746a2cf","uri":null,"name":"███████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7957c663-1b30-410a-af12-2e7d36578daa","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"62b8f623-e9fc-487f-9945-60328746a2cf"}],"recentChangeFlags":null},{"id":"0a840024-d2b1-463c-9927-6e03265a344c","uri":null,"name":"██████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ea494bd3-4fc9-4ae4-92cf-01b51ca1a3e1","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0a840024-d2b1-463c-9927-6e03265a344c"}],"recentChangeFlags":null},{"id":"447ce115-1a1c-4036-8c42-9540f5f46eb6","uri":null,"name":"██████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"05a56ae6-853c-4462-8396-6253fc76f125","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"447ce115-1a1c-4036-8c42-9540f5f46eb6"}],"recentChangeFlags":null},{"id":"eb21105e-23be-4839-ba41-c7fcc28143a7","uri":null,"name":"██████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"746dc4dd-5ca5-4208-90bf-825416d33809","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"eb21105e-23be-4839-ba41-c7fcc28143a7"}],"recentChangeFlags":null},{"id":"b259699c-99d5-47b7-9280-fca9a4f1f0cb","uri":null,"name":"███████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"10ad4948-fc46-4a51-99e7-b0bec994ea45","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b259699c-99d5-47b7-9280-fca9a4f1f0cb"}],"recentChangeFlags":null},{"id":"2e043b1c-c3d0-4e53-88f7-0331a2ccd19e","uri":null,"name":"█████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c77feebd-8677-489e-a198-69e38065616a","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"2e043b1c-c3d0-4e53-88f7-0331a2ccd19e"}],"recentChangeFlags":null},{"id":"20ead252-a475-4fd3-9477-9ab939be0ae8","uri":null,"name":"███████████████████████████","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"546f4482-9d0d-4f66-a6d9-e15123c9c103","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"20ead252-a475-4fd3-9477-9ab939be0ae8"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"20ead252-a475-4fd3-9477-9ab939be0ae8"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"20ead252-a475-4fd3-9477-9ab939be0ae8"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"20ead252-a475-4fd3-9477-9ab939be0ae8"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"20ead252-a475-4fd3-9477-9ab939be0ae8"}],"recentChangeFlags":null},{"id":"3e254a43-2c0e-4a6e-bb1d-e1f95356b556","uri":null,"name":"██████████████████████","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2a0fc8bc-a220-45cc-817f-48fe14845b37","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"3e254a43-2c0e-4a6e-bb1d-e1f95356b556"},{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"3e254a43-2c0e-4a6e-bb1d-e1f95356b556"},{"id":"4e683276-8d35-4745-9a7c-8172f1c8fd9e","name":"Radiofrequency Testing","targetId":"3e254a43-2c0e-4a6e-bb1d-e1f95356b556"},{"id":"9b8c3b7f-9a97-484b-94a0-b0f775144784","name":"WiFi","targetId":"3e254a43-2c0e-4a6e-bb1d-e1f95356b556"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"3e254a43-2c0e-4a6e-bb1d-e1f95356b556"}],"recentChangeFlags":null},{"id":"e921acef-09d3-4f4e-b41e-254b97067db4","uri":null,"name":"███████████████████████████████","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"47775319-3464-47a0-a7a3-e9a79fd341c2","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"e921acef-09d3-4f4e-b41e-254b97067db4"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"e921acef-09d3-4f4e-b41e-254b97067db4"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"e921acef-09d3-4f4e-b41e-254b97067db4"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"e921acef-09d3-4f4e-b41e-254b97067db4"}],"recentChangeFlags":null},{"id":"a9bd90ce-8481-4c11-bd4a-306372e47636","uri":null,"name":"██████████████████████████","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8429eb5a-7550-4f98-84d1-cb946024bd73","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a9bd90ce-8481-4c11-bd4a-306372e47636"}],"recentChangeFlags":null},{"id":"b6647221-2d28-42e1-af44-c5beb7c95c70","uri":null,"name":"███████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4d1b899d-9e07-4a8e-b278-d8ed8b009881","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"b6647221-2d28-42e1-af44-c5beb7c95c70"}],"recentChangeFlags":null},{"id":"30f43f38-a9f8-4b3d-b796-7786581c2b56","uri":null,"name":"████████████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7671b279-1513-40f9-9357-aaab33dff9c2","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"30f43f38-a9f8-4b3d-b796-7786581c2b56"}],"recentChangeFlags":null},{"id":"38aa78df-55f5-47a4-84fe-3fb8f773fb83","uri":null,"name":"███████████████████████████████████████████████████","category":"hardware","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"45efa636-7803-42cd-bbe5-c64aec8851f1","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"38aa78df-55f5-47a4-84fe-3fb8f773fb83"},{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"38aa78df-55f5-47a4-84fe-3fb8f773fb83"},{"id":"4e683276-8d35-4745-9a7c-8172f1c8fd9e","name":"Radiofrequency Testing","targetId":"38aa78df-55f5-47a4-84fe-3fb8f773fb83"},{"id":"9b8c3b7f-9a97-484b-94a0-b0f775144784","name":"WiFi","targetId":"38aa78df-55f5-47a4-84fe-3fb8f773fb83"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"38aa78df-55f5-47a4-84fe-3fb8f773fb83"}],"recentChangeFlags":null},{"id":"78242261-5bea-45b3-a8ff-250850621421","uri":null,"name":"████████████████████","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7b6778d7-9957-4311-8126-6c363b549ff2","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"78242261-5bea-45b3-a8ff-250850621421"},{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"78242261-5bea-45b3-a8ff-250850621421"},{"id":"4e683276-8d35-4745-9a7c-8172f1c8fd9e","name":"Radiofrequency Testing","targetId":"78242261-5bea-45b3-a8ff-250850621421"},{"id":"9b8c3b7f-9a97-484b-94a0-b0f775144784","name":"WiFi","targetId":"78242261-5bea-45b3-a8ff-250850621421"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"78242261-5bea-45b3-a8ff-250850621421"}],"recentChangeFlags":null},{"id":"6cbedebe-1ba6-4124-883d-e3b5072db837","uri":null,"name":"█████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9d329cdf-0bcb-42ee-bcfe-a48e081b9631","sortOrder":0},"sortOrder":0,"tags":[{"id":"6a9fe373-cb50-48a4-8f00-f390acde8447","name":"JSON","targetId":"6cbedebe-1ba6-4124-883d-e3b5072db837"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"6cbedebe-1ba6-4124-883d-e3b5072db837"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"6cbedebe-1ba6-4124-883d-e3b5072db837"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"6cbedebe-1ba6-4124-883d-e3b5072db837"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"6cbedebe-1ba6-4124-883d-e3b5072db837"}],"recentChangeFlags":null},{"id":"ff2c62d5-c97b-42a2-bf1f-e40427922f21","uri":null,"name":"█████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7901119a-4811-4f12-bb24-a42205247bfa","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"ff2c62d5-c97b-42a2-bf1f-e40427922f21"}],"recentChangeFlags":null},{"id":"9f055549-6947-4358-a34e-4e483a8eeed2","uri":null,"name":"█████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5bd28357-a920-41ca-b7b3-54ad308bffc2","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9f055549-6947-4358-a34e-4e483a8eeed2"}],"recentChangeFlags":null},{"id":"a73e60e9-f39e-4c9f-8958-a80d5d2cf7df","uri":null,"name":"█████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d8e7b811-e34e-4d6c-a468-03fbe8cf1908","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"a73e60e9-f39e-4c9f-8958-a80d5d2cf7df"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a73e60e9-f39e-4c9f-8958-a80d5d2cf7df"}],"recentChangeFlags":null},{"id":"99f04d6b-37ec-47ce-b949-fd4155cd8fb8","uri":null,"name":"██████████████████████████████████","category":"hardware","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"be177261-f8b8-4cea-94f5-b0cdbe75cac8","sortOrder":0},"sortOrder":0,"tags":[{"id":"6825f068-7447-450e-9134-158ae26e18d4","name":"Computer Hardware","targetId":"99f04d6b-37ec-47ce-b949-fd4155cd8fb8"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"99f04d6b-37ec-47ce-b949-fd4155cd8fb8"}],"recentChangeFlags":null},{"id":"24755eb5-6d73-4ab4-acb4-bdc3ddb964b5","uri":null,"name":"████████","category":"hardware","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"05ece49d-d9cd-4124-82e1-d5181fbcfe7a","sortOrder":0},"sortOrder":0,"tags":[{"id":"6825f068-7447-450e-9134-158ae26e18d4","name":"Computer Hardware","targetId":"24755eb5-6d73-4ab4-acb4-bdc3ddb964b5"},{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"24755eb5-6d73-4ab4-acb4-bdc3ddb964b5"}],"recentChangeFlags":null},{"id":"950fab49-3d51-4e07-bb0d-4b9eacf07a94","uri":null,"name":"█████████████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d16a8930-f7f6-494e-a8fe-1ba31f0b8027","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"950fab49-3d51-4e07-bb0d-4b9eacf07a94"}],"recentChangeFlags":null},{"id":"d32763b2-6c6a-43a2-bc79-4baf5f8e9067","uri":null,"name":"█████████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a64358d3-d4a8-40c4-ad99-627329edf70a","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"d32763b2-6c6a-43a2-bc79-4baf5f8e9067"}],"recentChangeFlags":null},{"id":"0b0dbc70-d775-4355-a7d3-86fc144ce406","uri":null,"name":"█████████████████████","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ab0c9259-18af-4944-92d8-6216cbdd1202","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"0b0dbc70-d775-4355-a7d3-86fc144ce406"}],"recentChangeFlags":null},{"id":"3cc9778e-c701-4c8a-8a6f-d3b00d2e3f4a","uri":null,"name":"█████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"02754850-34ca-493c-a540-ea804e4db572","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3cc9778e-c701-4c8a-8a6f-d3b00d2e3f4a"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"25f46050-f709-4279-a47a-8534b5b607f4","p1MaxCents":550000,"p1MinCents":350000,"p2MaxCents":250000,"p2MinCents":150000,"p3MaxCents":60000,"p3MinCents":30000,"p4MaxCents":25000,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":1000000},"descriptionHtml":"█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████","rewardRangeData":{"1":{"min":3500,"max":5500},"2":{"min":1500,"max":2500},"3":{"min":300,"max":600},"4":{"min":0,"max":250},"5":{"min":null,"max":null},"programMax":10000},"recentChangeFlags":null},{"id":"d1e54c58-9574-4320-8a15-f5c147e230a4","name":"████████████","targets":[{"id":"710178d3-3150-441e-9353-54a55aae36fb","uri":null,"name":"███████████████████████████████████████████████","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"afc52e84-c14e-4880-ac8d-3f29dec6f64f","sortOrder":0},"sortOrder":0,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"710178d3-3150-441e-9353-54a55aae36fb"}],"recentChangeFlags":null},{"id":"0f8403ac-9ef8-42c8-9121-fb615ccf9fed","uri":null,"name":"█████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c96858fb-f10d-4aea-910e-c217540c86aa","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0f8403ac-9ef8-42c8-9121-fb615ccf9fed"}],"recentChangeFlags":null},{"id":"3f8dd44d-58e9-4225-9534-85ad2c9a7aac","uri":null,"name":"█████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"acf156ae-972a-444b-9b63-8303371bc0ca","sortOrder":0},"sortOrder":0,"tags":[{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"3f8dd44d-58e9-4225-9534-85ad2c9a7aac"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3f8dd44d-58e9-4225-9534-85ad2c9a7aac"}],"recentChangeFlags":null},{"id":"1d8f4281-6469-4879-a71d-6453b79001d7","uri":null,"name":"██████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1dd7bd1b-ebbb-4f33-9894-6980ed0f4464","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"f30eabb3-3605-4f77-85a9-7791a022f156","uri":null,"name":"████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a5fae5c6-1de5-4a18-b61f-f00d908507a9","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"6c071fc7-b589-43d6-bc63-33f211023e0b","uri":null,"name":"██████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"82ab00e3-7c44-4a55-ace4-b9fd466e7f3b","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"f55b2cd3-de9a-4cfb-ad44-7971e9ccfc46","uri":null,"name":"███████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"57321bba-7365-4e36-bfdc-7167c1c51816","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f55b2cd3-de9a-4cfb-ad44-7971e9ccfc46"}],"recentChangeFlags":null},{"id":"9a4760ef-ec5b-48f3-b447-eb4e0658102b","uri":null,"name":"█████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"52604f34-34a2-4794-ae10-ed5fe8f77de3","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9a4760ef-ec5b-48f3-b447-eb4e0658102b"}],"recentChangeFlags":null},{"id":"55a663b4-743f-4d21-bd23-1d892b1befe6","uri":null,"name":"████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"01d5a2b8-be0a-4eaf-b518-ce89802c6fca","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"55a663b4-743f-4d21-bd23-1d892b1befe6"}],"recentChangeFlags":null},{"id":"b3088996-f00c-4642-b5b0-a7e111bc5937","uri":null,"name":"███████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"40402054-497c-45b5-9d72-c3b612758a84","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"1ab71bd9-0dda-43c8-9cc7-7eb2fcfa0603","uri":null,"name":"█████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bba6bbdf-61b5-46c2-b5fe-24b4a223b6cb","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e15772ed-4167-4bd3-9b23-77e804ba9919","uri":null,"name":"██████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"385b241c-393b-4b46-829b-2dc8cfbc0418","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"9c7038ec-753c-46d0-bf05-dfdfb975bcd5","uri":null,"name":"█████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d012d593-c771-4e5a-9de3-afb4dee46bf1","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"1c836954-33b0-46c3-a8e4-74661ad1bdc5","uri":null,"name":"████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"33eb8624-1c86-4b2c-8661-d9f278c91699","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"3ffb56ca-6063-4da9-848f-47bc84c97da4","uri":null,"name":"███████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"dba5bb2a-cbff-449e-a038-ee0cdffa6894","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a2281674-4361-4d74-b1a2-d18d601eadc9","uri":null,"name":"████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"48472173-7c01-4783-811f-93db03e52d02","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"6f52c00f-12eb-4d6c-a280-0f946d783cba","uri":null,"name":"████████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3a5ca795-ff80-425c-af38-7c26d8924d8f","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"3e0c3771-c694-47f4-bcba-fae92d345a52","uri":null,"name":"█████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9913965c-e116-4ba9-84ad-5242266fdb90","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"822c62fa-365f-475f-ba87-1fa802188814","uri":null,"name":"██████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1a318741-ad12-4d05-a548-ef562cd560e5","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"78adda46-5571-4dd2-9181-e34b1c9770b3","uri":null,"name":"███████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"da43bd9d-c5d2-4088-9466-dcc336c772a6","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"33920f6c-2d77-48b4-a6d8-b566d0cd6b02","uri":null,"name":"███████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"aecc5037-c7eb-40b0-994c-903690a1c48d","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"b60596b0-326b-49d0-a7c9-4c37bb56fb8a","uri":null,"name":"██████████","category":"network","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"21885247-de1d-49af-90c4-19df64cd24ec","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a959e3c5-2e5a-4044-85e3-574da0f4bd95","uri":null,"name":"█████████████","category":"network","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"82dc12ae-df1d-4923-ba54-15458de9792b","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"3a4c22c7-8e0c-4df6-a7d2-3680d0d2836c","uri":null,"name":"█████████████","category":"network","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8a4cb5ce-70d2-4f38-b813-716a7a880897","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"0327b50d-f28c-4420-92f3-e0a9a0417c73","uri":null,"name":"█████████████","category":"network","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ee151155-fda8-4c2d-8156-e617eae8bebe","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"ac92e041-d762-4f03-9446-c9fd52e33cf2","uri":null,"name":"███████████████","category":"network","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"336c7e30-c47a-4471-b5f8-e4b4ef6cb8d3","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"37bb5ecf-d04c-4665-ad24-83db479d7857","uri":null,"name":"█████████████","category":"network","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8a55bf96-c35e-4c88-8d53-d98b0fb62161","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"cdcf5df3-0f55-44ac-aa4f-a900e3c346de","uri":null,"name":"███████████████","category":"network","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0923c63f-8905-4299-83a3-ea06aaead602","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"5a925beb-9e76-40e4-a2c3-434a7ff5cf05","uri":null,"name":"██████████████","category":"network","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fc100c54-2af1-4a7f-8909-27853aa3a5e0","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"974d5207-f23c-4f00-916e-0c777caa9174","uri":null,"name":"██████████████","category":"network","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fffc9fdf-3bf2-4b2a-b534-339f7e675ebe","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"01474e9f-2345-42f9-a86f-c87f15b39335","uri":null,"name":"████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"69942f9d-57fd-45a4-a9af-bdee21cb40fc","sortOrder":30},"sortOrder":30,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"f89b01f6-4e23-4e00-9826-f2536d863baf","code":"xfinity-home","state":"in_progress_paused","endsAt":null,"bountyId":"027930fc-b8b6-4ebe-8116-530582a80b7b","startsAt":"2019-09-05T17:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Telecommunications","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/2a02/8676/2437c177/c1cc2dd912014795dcf6a92408477f84_corporate_Xfinity-Home.png","logoBackgroundColor":"#f4f4f4","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":"Hello Researchers,\n\nThank you for your continued engagement with our programs and for helping us strengthen the security of our products and services.\n\nDue to a significant increase in recent submissions, our team is currently reviewing a higher than normal volume of reports. To ensure we provide the level of attention and responsiveness that researchers deserve, we have decided to temporarily pause new submissions for our Bug Bounty programs while we work through the existing queue.\n\nWhat this means:\n\n- The Xfinity and Xfinity Home Bug Bounty programs will temporarily stop accepting new submissions.\n\n- Our Vulnerability Disclosure Program (VDP) remains open and available for reporting security issues. If you discover a vulnerability during this period, please continue to report it through the VDP.\n\n- Researchers with reports currently under review will continue to receive updates throughout the triage and remediation process.\n\n- Eligible reports that have already been submitted will continue through our normal triage, validation, and reward processes.\n\nThis pause is intended to help us improve responsiveness and ensure a high-quality experience for researchers who currently have reports under review.\n\nWe will share additional updates as they become available.\n\nCheers!\n\nComcast PSIRT","lastTransitionAt":"2026-07-13T17:53:34.201Z","cancellationReason":null,"statusLabel":"In progress paused","routesPaths":{"brief":"/engagements/xfinity-home","changelogs":"/engagements/xfinity-home/changelog","submissions":null,"announcements":"/engagements/xfinity-home/announcements","hallOfFame":"/engagements/xfinity-home/hall_of_fames","crowdstream":"/engagements/xfinity-home/crowdstream"},"announcementsCount":16,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Priority Triage","submitReportUrl":null,"methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=xfinity-home\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/xfinity-home/engagement_subscribers","engagementChangelogsUrl":"/engagements/xfinity-home/changelog","publishedAt":"2026-07-13T17:53:34.229Z","engagementChangelogUrl":"/engagements/xfinity-home/changelog/2a28998a-a3f5-4251-a7d6-cf3f735bb705","createUserFeedbacksUrl":"/engagements/xfinity-home/feedbacks","engagementCrowdstreamUrl":"/engagements/xfinity-home/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}