Indeed

Description

Our Mission: At Indeed, our mission is to help people get jobs. Since 2004, Indeed has given job seekers free access to millions of jobs from thousands of company websites and job boards. As the leading pay-for-performance recruitment advertising network, Indeed drives millions of targeted applicants to jobs in every field and is the most cost-effective source of candidates for thousands of companies. We take our security very seriously and welcome any responsible disclosure of potential gaps in our systems. Please read through the following details to help you focus on the areas most important to us. Indeed, at its discretion, may award an additional reward bonus for exceptional reports. Good luck, and happy hunting! Testing Requirement Test using only accounts created with @bugcrowdninja.com email addresses. Additional @bugcrowdninja.com email addresses can be requested using the credential request button at the bottom of this page. Include bugbounty in the company title you create and do not attempt to misrepresent yourself as a real company. Include the term bugbounty in all text fields including your user agent string. Program Ground Rules Respect our users' privacy. Leave the Site as you found it. Don't violate our Terms of Service or the law. Don't knowingly impact our services. No interacting with others. Cooperate with Indeed. Participation Eligibility. Follow Bugcrowd's rules. Respect our users’ privacy. If during your research you happen to encounter any information about another user or other individual, immediately stop and report this to Indeed. To participate in this program, you only need to explain the technical vulnerability you discovered. You must avoid any viewing, copying, altering, destroying, or otherwise interacting with any data, in particular data of other individuals, to which you may gain access through this research. If a vulnerability provides unintended access to data, limit the amount of data you access to the minimum required for effectively demonstrating the vulnerability; cease testing, and submit a report immediately if you encounter any user data during testing. This may include Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information. Leave the site as you found it. Do not copy, save, store, transfer, disclose, or otherwise retain any information you find on our site during your research, except to report your research to Indeed. Don't violate our Terms of Service or the law. All access to our Site must otherwise be in accordance with our Terms of Service and all applicable laws. In the event you access PII or other sensitive data, note that you are required to follow all laws and regulations applicable to the access and processing of such personally identifiable information and/or data, such as the California Consumer Privacy Act of 2018, the California Privacy Rights Act of 2020, New York Privacy Act 2021, once they become effective, and the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679), including the European Commission’s Standard Contractual Clauses regarding the transfer of personal data to processors. Don't knowingly impact our services. You must avoid causing any interruption or degradation of our services. Researchers who are found to be using aggressive automated tools will be blocked and removed from the program. When testing purchasing services on Indeed, limit any purchase amounts to the minimum necessary and under $10,000. No interacting with others. Any form of interaction with others on or through our Sites, including but not limited to other Indeed users, is strictly prohibited. On Indeed,close any active test jobs immediately after testing. On Indeed Flex, do not publish any jobs. Do not make any attempts to phish users or employees. Cooperate with Indeed. You will be expected to cooperate with us if we request your assistance in connection with your research. Participation Eligibility. Current employees or contractors of Indeed and Indeed Flex are not eligible to participate in the program. Former employees and contractors are eligible to participate in the program only, if: they have left Indeed and Indeed Flex more than 1 year prior to submission, and they are not making use of, or referring to, any non-public Indeed/Indeed Flex information obtained when they were an employee or contractor. Follow Bugcrowd’s rules. This program follows Bugcrowd’s standard disclosure terms .

Targets

Severity, Rewards & Reporting For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified using the methodology defined below. In an instance where an issue is downgraded, Indeed will try to provide a detailed explanation to the researcher - along with the opportunity to appeal, and make a case for a higher priority. However, discretion for determining final severity ratings remains with Indeed. When we are determining severity , the following descriptions are not meant to be absolute categorizations. Severity depends on potential damage to the business and clients, ease of abuse, how much we can actually fix, size of the user base, and sensitivity of the data. Note: A high severity finding on a demo application may be a P4 due to low impact and non-sensitive data. When we are determining rewards within a severity range, the difference between, for example, a High-P1 ($10,000) and a Low-P1 ($4,000) would depend on the number of prerequisites required , the difficulty , the impact and the likelihood of exploitation. For those reasons, we recommend providing: An attack scenario: what is the most likely way an attacker could abuse said vulnerability. Clear, numbered reproduction steps: if we can't easily reproduce what you are describing, we may misinterpret the issue or severity. A video Proof of Concept (PoC): for more complicated exploits. Impact: your understanding of the impact to Indeed or its users if an attacker exploits the said vulnerability Recommended fix: if you have any good ideas on ways to mitigate the risk without impacting normal users, it would be appreciated. In cases where Indeed has identified the same vulnerability through our internal tools and remediation is in-flight, the reward may be adjusted based on the value of the submission. Severity │ Description │ Examples P1 │ Vulnerabilities on Indeed applications that have the potential to: (1) affect most users, (2) disclose highly sensitive data, or (3) have a high impact on business operations. │ RCE on backend systems, authentication bypass leading to account compromise, privilege escalations from unprivileged to Admin or cross-organizational lateral movement, sensitive data exposure of Job Seeker or Employer PII P2 │ Vulnerabilities that have the potential to: (1) affect many users, (2) disclose sensitive data, (3) could lead to reputational or substantial business loss, or(4) affect the security or availability of individual processes or services. │ Stored XSS, exposed API credentials, subdomain takeovers on *.indeed.com P3 │ Vulnerabilities that can affect multiple or individual users with little to no user interaction, or only have security implications within an organizational context. │ Reflected XSS, misconfigured CORS. P4 │ Issues that affect multiple or individual users and may require user interaction or significant prerequisites to exploit. The potential business or user impact is likely low, or sensitivity of the data considered to be low. │ URL Redirects, Many Intra-organizational privilege escalations. Out of Scope AI Safety issues, getting the chatbot to say bad things is not a Security vulnerability Various Bias types defined by the VRT: Algorithmic biases, data biases, developer biases, societal biases, misinterpretation biases Sandboxed code executions within AI applications Multi-turn AI attack that isn’t reproducible Volumetric/Distributed denial of service attacks against AI-enhanced applications such as Career Scout BugCrowd Vulnerability Rating Taxonomy (VRT) Exceptions Some types of issues do not present a significant enough risk to Indeed, and are usually not accepted. Any submission of these types will only be rewardable if significant risk and impact can be demonstrated. Intra-Organizational Broken Access Controls, unless integrity impact is high Vulnerabilities dependent on unlikely high privileges (eg. malicious admin) User enumeration vulnerabilities Volumetric DoS vulnerabilities Debug/Stack trace/Errors with non-secret data Rate-limiting vulnerabilities, unless integrity impact is high External SSRF Internal SSRF without an impactful proof of concept HTMLi without a realistic and impactful proof of concept Self-XSS ​​Clickjacking on pages with no sensitive data or actions Attacks requiring Man-in-the-Middle or physical access to a user’s device WAF-bypass via Origin IP Vulnerabilities affecting users of outdated browsers SPF/DMARC/DKIM record missing on a domain SSTI, without impactful proof of concept Public API schema Helpful Tips For Your Testing Different Accounts Types and Roles: Job seekers and employer accounts have access to different features and views. You may want to set up test accounts as both. Organizations can have multiple employer accounts, each with different RBAC defined roles. See https://indeed.force.com/employerSupport1/s/article/206589143?language=en_US to learn more. Group similar submissions: We ask that researchers who are able to identify the same or similar types of issues in multiple locations, across one of our applications combine those findings into a single submission that includes a description as well as the various locations where vulnerabilities have been identified. Localization: Indeed is an international company with many different subdomains for different countries, running the same applications in different languages, example: mx.indeed.com, ca.indeed.com, in.indeed.com, vn.indeed.com. Localized versions can share the same codebase and therefore, a vulnerability found on many may only be eligible to be rewarded once. Third party applications: For third party applications, such as Wordpress, they will only be eligible for reward if there is action Indeed can take to mitigate issues identified, A good example of something we wouldn't payout for is the output of WPScan showing recently out of date plugins, since regular patching is part of our WP management. An example of something we would payout for is a POC showing unintended behavior that isn't in a vendor patch. Disclosing results: This bounty requires explicit permission to disclose the results of a submission. Documentation: Developer documentation: https://docs.indeed.com/ Target Overview Don’t know where to start? Here is a breakdown of a few different features at Indeed Target │ Description Career Scout │ Focus Areas Prompt injection, insecure output handling. Additionally all vulnerabilities we have in-scope are also relevant to our AI solutions, and we are particularly interested in: Authorization issues, Authentication issues, Sensitive data exposure, Stored or reflected XSS. https://secure.indeed.com │ Authentication services for job seekers and employers accessing Indeed products. Focus areas: Authentication bypass/flaws, Oauth flaws. http://secure.indeed.com/account/apikeys https://developer.indeed.com/ (api documentation) │ Register an application to access Indeed APIs Focus areas: Oauth flaws https://account.indeed.com │ Access control platform for employers to manage users and permissions across different Indeed products. Focus areas: broken access control, privilege escalation. https://profile.indeed.com │ Profile and resume creation or upload for Job Seekers. Start testing by going to https://profile.indeed.com and creating a profile. Focus areas: injection, file upload vulnerabilities https://employers.indeed.com │ The employer home platform. Post jobs, manage candidates, etc. Many employer-facing applications will be accessible and testable from here. Good place to begin testing. Focus areas: privilege escalation https://www.indeed.com https://www.indeed.com/jobs │ Job Search. Focus areas: injection https://m5.apply.indeed.com │ Apply for jobs. This application is accessible by clicking on the job “Apply” button. Remember to only test your own jobs! Focus areas: injection https://employers.indeed.com/interviews │ Indeed Virtual Interviews allows employers and job seekers to conduct virtual interviews on the platform. Start testing by scheduling a video interview with your test candidate and browsing to https://employers.indeed.com/interviews . Focus areas: privilege escalation, sensitive data exposure https://apis.indeed.com/graphql │ Indeed's federated GraphQL gateway. Focus areas: privilege escalation, sensitive data exposure. https://billing.indeed.com │ The billing management interface for employers' billing-related interactions. Start testing at https://billing.indeed.com/summary . Focus areas: sensitive data exposure portal.syftapp.com │ UK Employer portal portal.indeedflex.com │ US Employer portal agency.indeedflex.com │ Agency portal admin.indeedflex.com │ US Admin portal admin.syftapp.com │ UK Admin portal indeedflex.com │ Landing page https://play.google.com/store/apps/details?id=com.syftapp.android │ Android worker app https://apps.apple.com/gb/app/indeed-flex-job-search/id1013812731 │ iOS worker app https://play.google.com/store/apps/details?id=com.indeed.employer.mobile&referrer=utm_source%3Dlandingpage%26anid%3Dadmob │ Android Indeed Connect App for Employers https://apps.apple.com/us/app/indeed-connect-for-employers/id6443822731 │ iOS Indeed Connect App for Employers — Instructions for Testing Career Scout Claim a single jobseeker account from the Career Scout Credential account bucket below Install and open TestFlight on an iOS device or Apple Computer Open https://testflight.apple.com/join/veieI9UZ to accept access to the Indeed Jobsearch application within TestFlight Login to the claimed bugcrowdninja account, either by resetting the password through Forgot Password or by logging in via email Click on the Assist button in the navigation bar

Primary Targets (in scope)

https://*.indeed.com presents a large attack surface. All subdomains can be considered in-scope in the Primary Target grouping with the exception of those explicitly defined in-scope in the other target groupings or out-of-scope. We leave it to the researcher to discover subdomains not listed here.

Other Targets (in scope)

Any host/web property/mobile application owned by Indeed in which we can take action to mitigate the issue reported, but is not in scope as a Primary target.