{"id":"c2114872-cfb6-4a17-a4a8-923ba9a59e6a","engagementId":"40ba843d-1f8b-42a2-bb90-20f6d1d4e715","data":{"brief":{"id":"55d50f5f-d980-4fb3-a3a5-bd34cd29bac0","name":"Zaxbys Vulnerability Disclosure Engagement","tagline":"Please submit your findings to this Vulnerability Disclosure Engagement.","description":"\u003cp\u003eFounded in 1990, Zaxbys is committed to serving delicious chicken fingers, wings, sandwiches and salads in a fun, offbeat atmosphere where customers are considered friends. For the second year in a row, Zaxbys iconic Signature Sandwich won Thrillist’s 2022 Fasties Award for Best Fried Chicken Sandwich. Zaxbys has grown to more than 900 locations in 18 states and is headquartered in Athens, Georgia. \u003c/p\u003e\n\n\u003cp\u003eNo technology is perfect, and Zaxbys believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this engagement will use the\u003c/em\u003e \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" title=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003cem\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/em\u003e\u003c/a\u003e\u003cem\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"c85cd17d-3c78-44ca-a00b-40aff928e114","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Zaxbys not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e before submitting.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess/Credentials\u003c/h2\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" title=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. You may register for accounts \u003ca href=\"https://www.zaxbys.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003ePlease note that all researchers are testing within the same environment - please do not modify or tamper with any account you do not expressly own.\u003c/p\u003e\n\n\u003ch4\u003eNote - you MUST use a US based phone number in order to sign up for a Zaxbys account.\u003c/h4\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eSensitive data exposure—cross-site scripting (XSS) stored, SQL injection (SQLi), etc.— but not personally identifiable information or payment data\u003c/li\u003e\n\u003cli\u003eAuthentication- or session management-related issues\u003c/li\u003e\n\u003cli\u003eRemote code execution\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cp\u003eThis program does not extend to security research involving the following:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny non-public-facing Zaxbys system\u003c/li\u003e\n\u003cli\u003eAccess, collection, or any other interaction with personally identifiable information or payment data\u003c/li\u003e\n\u003cli\u003eExecuting or attempting to execute denial of service (DoS)—through network traffic, resources exhaustion, or other methods\u003c/li\u003e\n\u003cli\u003eUser enumeration\u003c/li\u003e\n\u003cli\u003eIssues only present in old browsers/plugins or end-of-life software browsers\u003c/li\u003e\n\u003cli\u003ePhishing or social engineering of Zaxbys employees or guests\u003c/li\u003e\n\u003cli\u003ePosting, transmitting, uploading, linking to, sending, or storing any malicious software or ransomware\u003c/li\u003e\n\u003cli\u003eExploitation of vulnerabilities for any purpose beyond reporting under this program\u003c/li\u003e\n\u003cli\u003eEngagement in any activity that disrupts services or impacts Zaxbys customers, employees, or business operations\u003c/li\u003e\n\u003cli\u003eDisclosure of known public files and other information disclosures that aren’t a material risk (e.g., robots.txt)\u003c/li\u003e\n\u003cli\u003eReports that do not demonstrate a tangible security risk or material issue such as HTTP 404 errors, descriptive error messages, or cosmetic/functional bugs that do not impact security\u003c/li\u003e\n\u003cli\u003eAny attack or vulnerability that hinges on a user’s computer first being compromised\u003c/li\u003e\n\u003cli\u003eViolation of any applicable international, federal, state, and/or local laws or any applicable agreements\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the\u003c/em\u003e \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" title=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003cem\u003eBugcrowd Support Portal\u003c/em\u003e\u003c/a\u003e \u003cem\u003ebefore going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"d2a1109e-a40f-47fd-82d7-22ada538f7a8","name":"In Scope","targets":[{"id":"8e85ccc9-d8a6-4f29-b102-ff3d2eb8af32","uri":"https://zaxbys.com/","name":"Zaxbys Website","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f34bf314-4fd6-4e80-9c45-1c037ccc281d","sortOrder":0},"sortOrder":0,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"8e85ccc9-d8a6-4f29-b102-ff3d2eb8af32"},{"id":"803518dc-5ae1-4e48-8de4-5b61b42a6bd0","name":"Amazon S3","targetId":"8e85ccc9-d8a6-4f29-b102-ff3d2eb8af32"},{"id":"9dd4899d-3a63-4126-8c83-c1fc1de50c25","name":"Amazon Cloudfront","targetId":"8e85ccc9-d8a6-4f29-b102-ff3d2eb8af32"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"8e85ccc9-d8a6-4f29-b102-ff3d2eb8af32"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"8e85ccc9-d8a6-4f29-b102-ff3d2eb8af32"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"8e85ccc9-d8a6-4f29-b102-ff3d2eb8af32"}],"recentChangeFlags":null},{"id":"fd2d6e7b-84dd-42d6-8323-df086a69f667","uri":"https://apps.apple.com/us/app/zaxbys/id480603264","name":"Zaxbys iOS Mobile Application","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5776ddf2-f762-4de0-9b41-a0bb5f0b70b7","sortOrder":1},"sortOrder":1,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"fd2d6e7b-84dd-42d6-8323-df086a69f667"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"fd2d6e7b-84dd-42d6-8323-df086a69f667"}],"recentChangeFlags":null},{"id":"da50bf92-6a88-4113-80ce-2258d674fc4d","uri":"https://play.google.com/store/apps/details?id=com.snapfinger.mobile.zaxbys\u0026hl=en_US","name":"Zaxbys Android Mobile App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"545b5fd5-fa5a-4644-b293-6e4be9672881","sortOrder":2},"sortOrder":2,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"da50bf92-6a88-4113-80ce-2258d674fc4d"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"da50bf92-6a88-4113-80ce-2258d674fc4d"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"40ba843d-1f8b-42a2-bb90-20f6d1d4e715","code":"zaxbys-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"f8c46b03-ee75-4d13-bdff-381c3eef58c7","startsAt":"2025-04-22T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Hospitality","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/b859/8db0/65e4b65c/b6567a552ab022abcf6ff9cdf9b4ba55_IMG_0091.jpeg","logoBackgroundColor":"#041e42","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-04-22T18:00:00.437Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/zaxbys-vdp-pro","changelogs":"/engagements/zaxbys-vdp-pro/changelog","submissions":null,"announcements":"/engagements/zaxbys-vdp-pro/announcements","hallOfFame":"/engagements/zaxbys-vdp-pro/hall_of_fames","crowdstream":"/engagements/zaxbys-vdp-pro/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/zaxbys-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=zaxbys-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/zaxbys-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/zaxbys-vdp-pro/changelog","publishedAt":"2025-10-20T17:15:39.642Z","engagementChangelogUrl":"/engagements/zaxbys-vdp-pro/changelog/c2114872-cfb6-4a17-a4a8-923ba9a59e6a","createUserFeedbacksUrl":"/engagements/zaxbys-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/zaxbys-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}