{"id":"6c840b8d-89e7-4cdb-a809-2c5a7f243164","engagementId":"e634d8e3-06bf-46a0-93bc-3c4c25b9b78f","data":{"brief":{"id":"f7604083-942a-4fb1-b9e4-073177e57cb4","name":"Zola Managed Bug Bounty ","tagline":"Submit your finding to the program!","description":"\u003cp\u003eZola recognizes the importance of security, privacy, and community. We value the input of the security community and welcome the opportunity to collaborate with community members to maintain a high standard for our users and to create a more secure Internet.\u003c/p\u003e\n\n\u003cp\u003eWe take security issues seriously. If you believe you've identified a vulnerability within our products, we would like to know about it. We'll investigate all submissions and do our best to fix issues. Thank you for taking an interest in making the Internet safer!\u003c/p\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified, in Zola’s sole but reasonable discretion, due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e\u003cbr\u003e\nCertain vulnerabilities may exist on multiple endpoints within the same entity and  may be considered as duplicates of each other. It is still recommended that you report them, as the team will investigate to see if they are unique. However,  please note that subsequent submissions may be marked as Not Applicable to prevent points farming. An example would be create/read/update/delete endpoints for the same entity with IDOR vulnerability. \u003c/p\u003e","industryTagId":"1bf3970a-395b-4456-b261-d04dab482af2","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Zola not listed in the targets section is out of scope, and you agree not to test or otherwise target any out-of-scope targets, domains or properties, including, without limitation, those listed in the “Out of Scope” section below. This includes any/all subdomains not listed above (e.g. subdomains such as \u003ccode\u003ehelp.zola.com\u003c/code\u003e would be out of scope, but everything under \u003ccode\u003ebaby.zola.com\u003c/code\u003e, such as \u003ccode\u003ebaby.zola.com/shop\u003c/code\u003e, would be in scope, unless stated otherwise in the Out-Of-Scope section). If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Zola, you can report it to this program.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eYou need a US-based device in order to properly access the iOS mobile application. The \u003ca href=\"https://apps.apple.com/app/apple-store/id6446598574?pt=31209800\u0026amp;ct=bugcrowd\u0026amp;mt=8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eZola Baby Registry application\u003c/a\u003e  is only available in the US App store.\u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eXSS\u003c/li\u003e\n\u003cli\u003eSQL Injection\u003c/li\u003e\n\u003cli\u003eFindings on the Mobile targets\u003c/li\u003e\n\u003cli\u003eAPI\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eAreas of focus from most to least important for Zola are listed below. Please note that this list does not directly correspond to  the Bugcrowd Vulnerability Rating Taxonomy. However, subject to some exceptions, the areas of higher priority for Zola are generally associated with increased technical severity under the Bugcrowd Vulnerability Rating Taxonomy.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAccount takeover\n\n\u003cul\u003e\n\u003cli\u003eLogin, session hijacking, cookie management, password reset/update, account invitation workflow, referral workflow\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eHorizontal/lateral authentication bypass \n\n\u003cul\u003e\n\u003cli\u003ePII, financial info, delivery address\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eVulnerabilities in core products\n\n\u003cul\u003e\n\u003cli\u003eRegistry\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope Elements and Prohibited Actions\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eContacting any email listed at https://baby.zola.com/contact-us\u003c/li\u003e\n\u003cli\u003eInappropriate graphics when testing upload functionality\u003c/li\u003e\n\u003cli\u003eChat feature\u003c/li\u003e\n\u003cli\u003eVolumetric (1000s of registry items/sizeable files)\u003c/li\u003e\n\u003cli\u003eDDoS/DoS (including application DoS)\u003c/li\u003e\n\u003cli\u003eFindings that only affect cosmetics/aesthetics\u003c/li\u003e\n\u003cli\u003eNetwork exhaustion\u003c/li\u003e\n\u003cli\u003eBrowsers not included in the following list:\n\n\u003cul\u003e\n\u003cli\u003eEdge, Firefox, Chrome, Mobile Chrome, Safari, Mobile Safari - last 2 versions\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eSocial engineering attacks of any kind\u003c/li\u003e\n\u003cli\u003eSpam or any other mass distribution to customers, partners, etc.\u003c/li\u003e\n\u003cli\u003eManipulating any user data or user accounts - researchers should not change or erase any customer data during testing\u003c/li\u003e\n\u003cli\u003eCustomer support channels (chat, phone, email, etc.)\u003c/li\u003e\n\u003cli\u003eAny domain/property of Zola not listed in the targets section is out of scope. This includes any/all subdomains not listed above\u003c/li\u003e\n\u003cli\u003eSpecific vulnerabilities:\u003c/li\u003e\n\u003cli\u003eUsername/Email Enumeration\u003c/li\u003e\n\u003cli\u003ePublicly accessible S3 buckets / objects\u003c/li\u003e\n\u003cli\u003eDNS misconfiguration\u003c/li\u003e\n\u003cli\u003eMail server misconfiguration\u003c/li\u003e\n\u003cli\u003eOrigin IP disclosure\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and, unless required of us by applicable law, we will not initiate or support legal action against you for accidental, non-negligent, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a one-time, limited basis for work done under this program (although we reserve the right to withdraw this waiver at any time if you do not comply with this policy and/or the standard disclosure terms (below)); and\u003c/li\u003e\n\u003cli\u003eHelpful to the overall security of the Internet and conducted in good faith.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eYou are expected, as always, to comply with all applicable laws, and by participating in this program, you agree to do so.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eThis program is subject to this policy and Bugcrowd’s \u003ca href=\"https://www.bugcrowd.com/resource/standard-disclosure-terms/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003estandard disclosure terms\u003c/a\u003e. By participating, you agree to these standard disclosure terms, including all terms and conditions referenced therein.\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"5550a09c-06df-4be5-9946-7bf7256ece81","name":"████████████████","targets":[{"id":"80d49cb8-867a-4e1f-974e-1f10581bc527","uri":null,"name":"██████████████████████","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"29227900-07fd-4465-bb11-e17977684b2d","sortOrder":0},"sortOrder":0,"tags":[{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"80d49cb8-867a-4e1f-974e-1f10581bc527"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"80d49cb8-867a-4e1f-974e-1f10581bc527"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"80d49cb8-867a-4e1f-974e-1f10581bc527"}],"recentChangeFlags":null},{"id":"81efbc78-f487-488b-bf07-9cf2f2925670","uri":null,"name":"██████████████████████████","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e085c4af-104d-4049-8b8b-40b389543d28","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"81efbc78-f487-488b-bf07-9cf2f2925670"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"81efbc78-f487-488b-bf07-9cf2f2925670"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"81efbc78-f487-488b-bf07-9cf2f2925670"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"81efbc78-f487-488b-bf07-9cf2f2925670"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"44ecc4ed-dd73-4fac-98b0-af508024c9d4","p1MaxCents":200000,"p1MinCents":150000,"p2MaxCents":120000,"p2MinCents":80000,"p3MaxCents":60000,"p3MinCents":40000,"p4MaxCents":20000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████","rewardRangeData":{"1":{"min":1500,"max":2000},"2":{"min":800,"max":1200},"3":{"min":400,"max":600},"4":{"min":150,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"fd2b630a-073b-419c-800c-ff3ffb7621a5","name":"████████████","targets":[{"id":"9ddcc948-25d4-492e-947f-106d2103b946","uri":null,"name":"████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4fcae1b8-8466-4e69-81f2-0f0485e3b7c3","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"18b2f514-3534-436d-90bc-d78e64a5f7a0","uri":null,"name":"██████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8cf92c70-8a43-4860-ab2c-cef50d37f2de","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"15b033bb-4c88-41d9-b843-bfde7fcb30bf","uri":null,"name":"████████████████████████████","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1c8640b5-6dcc-4926-ba4c-92ddea0efd95","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"9b15e09f-be2b-4487-88ce-91e3f31125df","uri":null,"name":"███████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8e1218ea-1bec-4333-a6fd-09c810fee64b","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"fd08f6e7-9415-45dc-9f90-fd1eec4e6163","uri":null,"name":"█████████████████████████████████████████","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"62d59d2c-3ee7-4f35-aed9-d910bb02c553","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"e634d8e3-06bf-46a0-93bc-3c4c25b9b78f","code":"zola-mbb-og","state":"in_progress_paused","endsAt":null,"bountyId":"b3e58bf6-ab85-41ce-9ada-f7d41dd2850b","startsAt":"2021-07-27T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"eCommerce","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/654a/fa1b/de653413/deeb276f4c542f29d5f0e94469998c2a_zola-logomark-square.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":false,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":"Program Pause","lastTransitionAt":"2026-02-10T15:06:01.584Z","cancellationReason":null,"statusLabel":"In progress paused","routesPaths":{"brief":"/engagements/zola-mbb-og","changelogs":"/engagements/zola-mbb-og/changelog","submissions":null,"announcements":"/engagements/zola-mbb-og/announcements","hallOfFame":"/engagements/zola-mbb-og/hall_of_fames","crowdstream":"/engagements/zola-mbb-og/crowdstream"},"announcementsCount":7,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":null,"methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=zola-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/zola-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/zola-mbb-og/changelog","publishedAt":"2026-02-10T15:06:01.623Z","engagementChangelogUrl":"/engagements/zola-mbb-og/changelog/6c840b8d-89e7-4cdb-a809-2c5a7f243164","createUserFeedbacksUrl":"/engagements/zola-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/zola-mbb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}