Chipotle Managed Bug Bounty Engagement

Description

Chipotle Mexican Grill, Inc. (NYSE: CMG) is cultivating a better world by serving responsibly sourced, classically-cooked, real food with wholesome ingredients without artificial colors, flavors or preservatives. Chipotle has over 3,250 restaurants in the United States, Canada, the United Kingdom, France and Germany and is the only restaurant company of its size that owns and operates all its restaurants in North America and Europe. Chipotle is ranked on the Fortune 500 and is recognized on the 2023 list for Fortune's Most Admired Companies and Time Magazine's Most Influential Companies. With over 110,000 employees passionate about providing a great guest experience, Chipotle is a longtime leader and innovator in the food industry. Chipotle is committed to making its food more accessible to everyone while continuing to be a brand with a demonstrated purpose as it leads the way in digital, technology and sustainable business practices. For more information or to place an order online, visit www.chipotle.com. No technology is perfect and Chipotle Mexican Grill, Inc. believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting! Please note: Only Critical (P1), Severe (P2), Moderate (P3), Low (P4) submissions will be rewarded. P5 findings will be marked as Informational. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. We strive to pay bounty on "Triage" and will do so when there is high confidence in the accuracy of the assigned scope and severity. Occasionally, we may need to delay payment until we fully investigate the details of a report. All bounty amounts will be at the discretion of the Chipotle Bug Bounty team. Bounty-eligible findings with priority higher than P4, that include a unique Nuclei Template to validate the finding will be rewarded a $250 bonus payment. Vulnerabilities with existing community templates will not be eligible for the bonus payment. Chipotle retains a perpetual right to utilize and distribute any templates submitted as part of a report. Reports submitted using methods that violate policy rules will not be eligible for reward. Understand that there could be submissions for which we accept the risk, have other compensating controls, or will not address in the manner expected. Generating fraudulent Chipotle coupons or simply getting free meals, to "steal money from Chipotle" is typically not evaluated as a critical issue but may still be eligible for a bounty. You are more likely to receive a bounty by finding and demonstrating a security impact within the published scope rather than by submitting a bug that's outside of scope and trying to convince us why you believe it’s a security risk for Chipotle. Legal Chipotle reserves the right to modify terms and conditions of this program and your participation in the program constitutes acceptance of all terms. Please check this site regularly as we routinely update our program terms and eligibility, which are effective upon posting. We reserve the right to cancel this program at any time. Must be 18 or older to be eligible for an award. Chipotle is the program owner and all the information described in this “Program Overview” are “program details.” Together these program details and the terms constitute the “Program Brief” referenced in the SDT. You acknowledge and agree (i) that you are already bound to the terms and conditions stated in Bugcrowd’s Standard Disclosure Terms, which can be found at https://www.bugcrowd.com/resources/essentials/standard-disclosure-terms and (ii) that Chipotle may directly enforce any breach by you of the Standard Disclosure Terms, which are supplemented by the additional terms in this program. Program Eligibility You must agree and adhere to the Program Rules and Legal terms as stated in this policy. You must be the first to submit a sufficiently reproducible report for an issue to be eligible for a bounty. Chipotle employees and vendors are not eligible for participation in this program. Past Chipotle employees are subject to a 90-day exclusion cooldown on your participation in this program. We will not accept submissions from you until 90 days after you've left the company, to minimize conflicts of interest. You must be available to supply additional information, as needed by our team, to reproduce and triage the issue. Zero-day vulnerabilities will not be considered for eligibility until more than 30 days have passed since a fix is published. Out-of-scope vulnerability reports may be addressed as a form of vulnerability disclosure but will generally not be considered reward eligible. Program Rules Do Perform testing using only accounts that are your own personal/test accounts or an account that you have the explicit permission from the account holder to utilize. Exercise caution when testing to avoid negative impact to customers and the services they depend on. Stop when unsure. If you think you may cause, or have caused, damage with testing a vulnerability, report your initial finding(s) and request authorization to continue testing. If you can access or modify personal data of Chipotle customers or other sensitive data, immediately contact Chipotle - do not attempt to conduct post-exploitation work. Do NOT Do not Brute force credentials or guess credentials to gain access to systems. Do not participate in denial-of-service attacks. Do not upload shells or create a backdoor of any kind. Do not engage in any form of social engineering of Chipotle employees, customers, or vendors. Do not engage or target any Chipotle employee, customer or vendor during your testing. Do not attempt to extract, download, or otherwise exfiltrate data which you believe may have personally identifiable information (PII) other than your own. Do not change passwords of any account that is not yours or that you do not have explicit permission to change. If ever prompted to change a password, stop and report the finding immediately to the Program Owner. Do not publicly disclose vulnerability reports that are not resolved and approved for disclosure by Chipotle. Do not use, share, publish, or disclose information obtained while identifying issues. After submitting you must delete, purge, and/or destroy all copies of information or digital samples. Do not submit reports here to engage us to buy your products or services. Please direct your sales inquiries through proper channels.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Chipotle Mexican Grill, Inc. not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Chipotle Mexican Grill, Inc., you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Access All of the targets are accessible via the public internet and available When accessing any service hosted by Chipotle Mexican Grill, Inc. please add the following request header. Identifier │ Header │ Example Username │ X-Bug-Bounty: Bugcrowd- │ X-Bug-Bounty: Bugcrowd-proresearcher Credentials: Accounts are self signup, please use your Bugcrowdninja email Checkout: Chipotle does NOT support order cancellation currently. You may test the checkout process for the following actions - Redeeming rewards from points. Adding items to a cart. Adding a card to a wallet. Redeeming promo codes. Do not place an order if you are not hungry . If you place an order, we will NOT be able to offer refunds or cancel your order. Out of Scope Vulnerabilities In-store technologies. International sites such as chipotle.fr, chipotle.de, chipotle.ca and any others that are not explicitly listed in-scope. If a subdomain is not part of the main online ordering application, it’s likely out of scope. Third party hosted websites – ir.chipotle.com, facilities.chipotle.com, community.chipotle.com etc. Internal service sites presenting a chipotle.com certificate such as help.chipotle.com Any vulnerabilities found in third-party software. Any physical attempts against Chipotle property or data centers. Rate limit testing, Denial-of-Service attacks and other volume-based tests are out-of-scope for the program. Missing cookie flags on non-sensitive cookies. Exposure of public keys (these are designed to be public, please review the type of encryption key before reporting it). Any research, data access or testing that violates the law. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.

In Scope (in scope)

In Scope The Bug Bounty Program will cover the following technological assets owned and operated by Chipotle: In-scope Online ordering applications: a. www.chipotle.com b. www.chipotle.co.uk c. catering.chipotle.com APIs: a. Publicly accessible APIs: services.chipotle.com Mobile Applications a. iOS and Android versions of our official mobile app Target Information: All of the below targets are publicly accessible. Accounts can be provisioned where self signup is available. Online ordering applications: a. https://www.chipotle.com b. https://www.chipotle.co.uk c. https://catering.chipotle.com APIs: a. Publicly accessible APIs: services.chipotle.com Mobile Applications a. iOS and Android versions of our official mobile app as indicated below:

• iOS Bundle IDs:
• Chipotle US: com.chipotle.Chipotle
• Chipotle UK: com.chipotle.Chipotle.eu
• Android Bundle IDs:
• Chipotle US: com.chipotle.ordering
• Chipotle UK: com.chipotle.ordering.eu