Navan

Description

1. Welcome Discover the magic of Navan: Business Software Designed for People. No technology is perfect, and Navan believes that working with skilled security researchers around the globe is crucial for identifying weaknesses. We are excited to have you participate as a security researcher and help us identify vulnerabilities in our assets. Good luck, and happy hunting!
2. Program Scope & Targets To continue participating in the program, you may: Join the company on Bugcrowd, or Create a new company account through our self-service sign-up in production: https://navan.com All guidance below applies to testing in production at: https://app.navan.com Testing is only authorized on targets listed as in scope in the Bugcrowd program brief. Any Navan domain/property not listed as in scope is out of scope . This includes any/all subdomains not explicitly listed. If you identify a vulnerability on a target that is not in scope but clearly belongs to Navan, you may submit it: It will be reviewed for awareness and remediation. It will not be eligible for rewards or points-based compensation. Always refer to the live Bugcrowd program page for the authoritative, current scope. Primary app: https://app.navan.com
3. Access & Account Creation (Production) 3.1 Primary URL All testing is conducted on: https://app.navan.com 3.2 Two options for access You can access Navan in production in two ways: Option A – Private Self-Service Sign-up Environment Sign up a new company in production. Use this if you want a private, isolated environment where no other test users exist. Requirements: You will need your own domain (e.g. example-bc-test.com ). You must have email addresses on that domain for your test users (e.g. [email protected] ). You MUST use first and last name as test. Company name must be in the following format “Bugcrowd-randomString123”. Sign-up steps: Go to: https://navan.com . Use the tile “Create a company travel program” → click Get started . On the next screen, add a test email . You need to have a real inbox on an address; use Bugcrowd + some random string so each tester has a unique address). Click Continue with email . Check the inbox for an email titled “Verify your email to start using Navan” . Click Verify email → the sign-up form opens. Fill the form as follows: First name and last name: you must use Test / Test . Company name: use Bugcrowd-randomString123 . Annual travel budget: 0–50K . Other fields: as you wish. When all fields are filled → click Create account . On the following page → click Start company setup . You should be logged into the app (e.g. you see the Home screen). This gives you: A private production testing environment that you fully control. No other Bugcrowd researchers in that company by default, so you can freely test without worrying about interfering with others. You may still use your @bugcrowdninja.com email for Bugcrowd-related communication, but the Navan environment itself can be tied to your own test domain and mailboxes. Option B – Shared Bugcrowdninja Sandbox Company Use this if you’re comfortable sharing an environment with other researchers. This Bugcrowdninja company is a shared environment used by multiple researchers. Contact the Bugcrowd triage team through the Bugcrowd platform. Request a Navan production sandbox test account for https://app.navan.com . You must use an email address on the @bugcrowdninja.com domain. Only @bugcrowdninja.com emails are allowed for these shared test accounts. Triagers use admin + delegate accounts to: Create a user for you in the shared sandbox company. Assign roles as needed (e.g. Traveler, Travel Admin, Expense Admin).
4. Shared Sandbox Company Overview (Bugcrowdninja Option) If you choose the shared Bugcrowdninja company route ( Option B ): All researchers share the same test company on app.navan.com . This company is divided into: a. Travel b. Expense Implications: Trips, expenses, users, and settings may be created or used by other researchers. Your changes can affect their tests, so shared-environment rules apply (see Section 9). If you use self-signup ( Option A ), you will have your own company and do not share data with other researchers in that environment.
5. Travel Functionality The Travel area supports booking and managing business trips. You can test functionality such as: Booking: Flights Hotels Trains Car rentals Managing trips: Viewing itineraries Modifying or canceling segments (where allowed) Inviting guests to trips and managing guest details Any other travel-related features visible in the UI You are encouraged to explore these flows within scope, while following shared-environment rules if using the Bugcrowdninja company.
6. Expense Functionality The Expense area focuses on submitting and managing travel-related and business expenses. You can test functionality such as: Creating expenses and attaching receipts Submitting expense reports for approval Managing expenses that may be tied to: Navan corporate card transactions (if configured/visible) Reviewing policies and approval workflows available to your roles Again, treat existing data as potentially belonging to others if you’re in the shared Bugcrowdninja company.
7. Roles and Permissions Many features are role-based. Common roles include: Travel Admin Expense Admin Traveler Other internal roles as configured Your roles determine what you can access and perform. 7.1 Requesting roles / additional test accounts To test role-based behavior: Via Bugcrowdninja (shared): Ask Bugcrowd triagers to create more test accounts or adjust roles for you. Via self-signup (private): Use your own admin account to create additional test users on your own domain and assign roles yourself. Do not permanently alter other users’ roles in the shared environment. If you discover a privilege escalation or cross-account access, stop and report it .
8. Shared Environment Rules (Bugcrowdninja Company) These rules apply only when using the shared Bugcrowdninja company ( Option B ). In your private self-signup environment ( Option A ), you can freely modify your own company. 8.1 Respect other researchers’ data Assume that any user, trip, expense, or configuration you did not clearly create yourself may: Belong to another researcher, or Be used for another test scenario. Avoid: Deleting or overwriting other researchers’ data. Making large, global configuration changes. 8.2 Destructive actions You should test fully within scope, but be very careful with destructive actions, such as: Deleting users, trips, expenses, or reports. Changing or deleting global/company-level settings and policies. Performing bulk or mass operations. Actions labeled: Delete / Remove / Purge , Reset , Close / Terminate / Cancel (user or company level). Best practice in shared environment: Perform destructive tests only on data you clearly own. For example: User: BC-<your_handle>-User1 Trip: BC-<your_handle>-Trip1 Expense Report: BC-<your_handle>-Expenses1 In your self-signup private environment, you can safely perform destructive tests on your own company data, as no other researchers share it.
9. Test Data & Privacy Requirements Regardless of whether you’re using Bugcrowdninja or self-signup: Do not use real personal or financial information. Prohibited: Real PII: real home addresses, real passport/ID numbers, real personal phone numbers (beyond minimal, non-sensitive test data). Real credit card or bank account details. Any confidential data you would not want exposed. Use only dummy/test data for names, contact details, payment information, and document numbers. Even in private self-signup environments, we recommend using only test data.
10. Test Credit Card Details For testing payment flows and booking: Field │ Value Brand │ Visa Card Number │ 4242 4242 4242 4242 Expiration Date │ Any future date CVV │ Any 3 digits More test credit card information: Stripe testing documentation Use this test card only in test/payment flows designed for it. Additional test card information may be provided in the Bugcrowd brief or Navan docs.
11. Focus Areas We are especially interested in: Travel and Expense end-user and Admin applications. PII exposure , particularly cross-tenant PII exposure : Some PII may legitimately be visible for booking on behalf of others. However, it should be appropriately limited and controlled. Findings around improper PII access or cross-tenant leakage are high-value.
12. Ratings, Rewards & Domain Reimbursement 12.1 Ratings & rewards For initial prioritization and rating of findings, we use the Bugcrowd Vulnerability Rating Taxonomy (VRT) as a baseline: https://bugcrowd.com/vulnerability-rating-taxonomy Used for: Initial severity rating Initial reward determination However: Severity may be adjusted up or down based on actual impact and likelihood in Navan’s environment. If an issue is downgraded, we will: Provide a detailed explanation. Offer you an opportunity to appeal and make a case for a higher rating. Reward ranges: Published ranges are guidelines , not hard caps. We may pay above the listed ranges if we believe a vulnerability poses a higher risk than anticipated. 12.2 Domain registration reimbursement For research that requires you to register a domain (especially relevant for self-signup private environments): Use an existing domain if you have one. If you already own a domain that you can reasonably use for testing, you should use that domain instead of registering a new one specifically for this program. Navan will reimburse standard domain registration fees for any valid report that requires such registration. This applies both to: Domains needed to provision your own self-signup production environment, and Domains needed for vulnerability scenarios (e.g. email spoofing, redirect targets). One-time reimbursement per researcher. If you qualify for a domain reimbursement, it will be a one-time payment for a domain associated with a valid, non-duplicate submission. Only one domain reimbursement is allowed per researcher, after a valid, non-duplicate submission is accepted. Coordinate reimbursement details through Bugcrowd triage as part of the report process.
13. Automated Tooling Requirements When using automated tools (scanners, fuzzers, scripts, etc.) against Navan: Every request from automated tooling must include this HTTP header: X-Bugcrowd-Id: <your_bugcrowd_username> Where <your_bugcrowd_username> is your Bugcrowd handle. Important: Requests from automated tools without this header may be blocked. Such requests may not qualify for safe harbor protections under the program. Ensure your tooling is configured to always set this header.
14. Quality Submissions High-quality reports: Triage faster. Are more likely to get accurate severities and rewards. To help us reproduce and assess issues quickly: Include complete HTTP requests for key steps. Include valid JWT tokens (or relevant authorization material) where appropriate: This clarifies the assumed access model. It allows efficient internal replication. Avoid sharing unnecessary secrets, and use Bugcrowd’s secure channels for sensitive material.
15. Prohibited Activities & Disclosure Researchers are not allowed to: Perform denial-of-service attacks, including distributed denial-of-service (DDoS) attacks, traffic flooding, or any other activity intended to degrade or disrupt the availability or performance of Navan services. Use automated scanners or other automated tooling unless explicitly permitted by the Bugcrowd program brief and/or pre-approved by Navan (via Bugcrowd triage). If automated tooling is permitted, it must comply with Section 13 and include the required X-Bugcrowd-Id header on every request. Publicly disclose vulnerabilities, exploit details, or any findings related to this program without Navan’s prior written approval , and you must follow Bugcrowd’s disclosure guidelines.
16. Safe Harbor If you follow this policy and the Bugcrowd program rules, Navan considers your research to be: Authorized under the CFAA and similar state laws. We will not initiate or support legal action against you for accidental, good-faith violations of this policy. Exempt from the DMCA for circumvention done in the course of legitimate, good-faith security testing under this policy. Exempt from conflicting Terms & Conditions that would otherwise restrict security research, on a limited basis for this work. Lawful, good-faith research that benefits Navan and Internet security. You are still responsible for complying with all applicable laws . If you are ever unsure whether your activity is allowed: Open a ticket with Bugcrowd Support and ask for clarification before proceeding.
17. Questions & Support Contact the Bugcrowd triage team via the Bugcrowd platform for: Scope questions (in-scope vs out-of-scope). Access issues for https://app.navan.com . Problems with your test account or roles. Requests for additional test accounts (shared or private). Questions about destructive testing in the shared Bugcrowdninja company. Clarification about staging decommissioning and production migration. Details on domain registration reimbursement for valid reports. We appreciate your continued engagement and look forward to your ongoing research in the production environment. Converted from the updated Navan Bugcrowd researcher guide PDF. Option labels in §4 and §8 of the PDF are inconsistent with §3; this document uses **Option A = private self-signup , *Option B = shared Bugcrowdninja * throughout.

Targets

1. Program Scope & Targets To continue participating in the program, you may: Join the company on Bugcrowd, or Create a new company account through our self-service sign-up in production: https://navan.com All guidance below applies to testing in production at: https://app.navan.com Testing is only authorized on targets listed as in scope in the Bugcrowd program brief. Any Navan domain/property not listed as in scope is out of scope . This includes any/all subdomains not explicitly listed. If you identify a vulnerability on a target that is not in scope but clearly belongs to Navan, you may submit it: It will be reviewed for awareness and remediation. It will not be eligible for rewards or points-based compensation. Always refer to the live Bugcrowd program page for the authoritative, current scope. Primary app: https://app.navan.com Researcher email domain: bugcrowdninja.com
2. Test Credit Card Details For testing payment flows and booking: Field │ Value Brand │ Visa Card Number │ 4242 4242 4242 4242 Expiration Date │ Any future date CVV │ Any 3 digits More test credit card information: Stripe testing documentation Use this test card only in test/payment flows designed for it. Additional test card information may be provided in the Bugcrowd brief or Navan docs.
3. Access & Account Creation (Production) 3.1 Primary URL All testing is conducted on: https://app.navan.com 3.2 Two options for access You can access Navan in production in two ways: Option A – Private Self-Service Sign-up Environment Sign up a new company in production. Use this if you want a private, isolated environment where no other test users exist. Requirements: You will need your own domain (e.g. example-bc-test.com ). If you do not have one or cannot create one , use a fake domain name that contains “bugcrowd” in the domain name (e.g. bugcrowdninja-hunt1.com ). You must have email addresses on that domain for your test users (e.g. [email protected] ). If you used a fake domain (e.g. bugcrowdninja-hunt1.com ), ensure you create a profile with “test” as first AND last name for this to work. They MUST use first and last name as test. Company name must contain “bugcrowd”. Sign-up steps: Go to: https://navan.com . Use the tile “Create a company travel program” → click Get started . On the next screen, add a test email . You need to have a real inbox on an address whose domain includes the word “Bugcrowd” (e.g. a domain you control that contains that word — not the literal example email from the guide; use Bugcrowd + some random string so each tester has a unique address). Click Continue with email . Check the inbox for an email titled “Verify your email to start using Navan” . Click Verify email → the sign-up form opens. Fill the form as follows: First name and last name: you must use Test / Test . Company name: use Bugcrowd . Annual travel budget: 0–50K . Other fields: as you wish. When all fields are filled → click Create account . On the following page → click Start company setup . You should be logged into the app (e.g. you see the Home screen). This gives you: A private production testing environment that you fully control. No other Bugcrowd researchers in that company by default, so you can freely test without worrying about interfering with others. You may still use your @bugcrowdninja.com email for Bugcrowd-related communication, but the Navan environment itself can be tied to your own test domain and mailboxes. Option B – Shared Bugcrowdninja Sandbox Company Use this if you’re comfortable sharing an environment with other researchers. This Bugcrowdninja company is a shared environment used by multiple researchers. Contact the Bugcrowd triage team through the Bugcrowd platform. Request a Navan production sandbox test account for https://app.navan.com . You must use an email address on the @bugcrowdninja.com domain. Only @bugcrowdninja.com emails are allowed for these shared test accounts. Triagers use admin + delegate accounts to: Create a user for you in the shared sandbox company. Assign roles as needed (e.g. Traveler, Travel Admin, Expense Admin). Focus Areas: Travel and Expense end user and Admin applications PII exposure, particularly cross tenant PII exposure. Note that some PII needs to be shared for people booking for other people, but it should still be limited. Out of Scope: Rate Limiting Distributed Denial of Service (DDos) Self-DoS issues (as in, only the person doing the action is denied service). Clickjacking, which involves manipulating user interfaces Absence of or invalid SPF records Unauthorized access to our Atlassian Service Desk Google API Key Disclosures Enumerating email addresses through login attempts. Expiration of password reset links. Domain Takeover via Available S3 .tripactions.com Buckets Reports related to the disclosure of Exif metadata from uploaded files Reports related to third-party components, like chat services, are excluded from this bug bounty program's scope Reports related to weak SSL ciphers, which are a part of the broader SSL configuration Reports related to the sign-up process using your bugcrowdninja email address - this process was created to facilitate testing and doesn’t reflect actual product behaviour Quality Submissions: Submitting high-quality vulnerability reports is crucial for ensuring faster processing times and increasing the chances of receiving rewards. To facilitate quick replication and assessment of the reported vulnerability: It is important to provide complete HTTP requests, including valid JWT tokens. These tokens help in understanding the assumed access model and enable efficient investigation and validation of the vulnerability. By including all necessary information, submitters can contribute to a smoother and more efficient vulnerability assessment process. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.

In Scope (in scope)

Navan is a platform that companies use to manage employee travel and expenses from a single portal. They welcome testing on their services as to help find security vulnerabilities to ensure the users of their platform are secure. In particular, there are a number of roles (admin, user, guest, etc.) that the Navan team is interested in understanding access control issues around.