SEEK

Description

SEEK is Australia's no. 1 jobs, employment, career and recruitment site. We invite the security researcher community to test SEEK's web applications and services. Thank you for participating! Program Requirements Denial of Service, Rate Limiting, and other automated/volumetric attacks are not permitted. Do NOT use automated tooling against SEEK assets. Customer instances are not to be accessed in any way (no customer data is to be accessed, and customer credentials are not to be used or "verified"). All testing must be conducted using your @bugcrowdninja.com email ID only. If you fail to use your @Bugcrowdninja.com email ID, you run the risk of getting blocked from accessing SEEK applications. We do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human input will be rejected. Ratings / Rewards For initial prioritisation, this program uses the Bugcrowd Vulnerability Rating Taxonomy . Priority may be adjusted based on likelihood or impact. Where an issue is downgraded, a full explanation will be provided and the researcher may appeal. To maximise your reward and reduce payout time, please include: Attack scenario : the most likely way an attacker could abuse this vulnerability. Clear reproduction steps : if we can't replicate the issue, we may not consider it serious. Recommended fix : practical mitigation suggestions add value to the submission. Triage SLA P1/P2: triaged within one business week. P3/P4/P5: triaged within three business weeks.

Targets

Testing is only authorised on assets listed as in scope. Any SEEK domain or property not listed is out of scope, including subdomains not explicitly covered by a wildcard. If you identify a vulnerability on a SEEK-owned asset that is not in scope, you may report it, but it may be ineligible for rewards. Do not submit contact forms, create support tickets, send emails, or otherwise generate work for staff outside the security team. Focus Areas Access to customer PII (jobseeker profiles and CVs). SEEK corporate data. Access to SEEK's internal network. Target Information Target │ Information *.seek.com │ Gives jobseekers a way to search and apply for jobs posted by advertisers (companies, recruiters, etc who post jobs). Jobseekers are able to upload a CV (resume), add profile information through the jobseeker website. *.employer.seek.com │ Designed for advertisers to post jobs onto *.seek.com and manage jobseekers who apply for the job. *.seekpass.co │ Formerly Certsy, helps job seekers to verify their claimed credentials (e.g. right to work, valid driver's licence, etc) by providing evidence (eg passport, drivers licence, etc) that we can check with relevant authorities or other verification methods. *.jobsdb.com │ SEEK's Asia jobseeker platform across Hong Kong and Thailand. Provides jobseekers a way to search and apply for jobs posted by advertisers, upload CVs, and manage profile information *.jobstreet.com │ SEEK's Asia jobseeker platform across Indonesia, Malaysia, Philippines, and Singapore. Provides jobseekers a way to search and apply for jobs posted by advertisers, upload CVs, and manage profile information. *.skinfra.xyz , *.myseek.xyz , *.outfra.xyz │ Used to host SEEK's corporate services and API's that are not designed to be accessed or consumed directly by customers but instead by SEEK employees and services. *.sol-data.com , *.jobapi.net │ Used for capturing search metrics, search API's including jobs, locations, salaries, etc. Some of these domains may not return any content by themselves, but are used within the context of typical application usage (e.g. authentication flows). Some host sites or APIs but most should be for SEEK employees only. Credentials Please sign up for accounts using your @bugcrowdninja.com email address: *.seek.com *.employer.seek.com SEEK Pass ( https://app.seekpass.co/sign-in ) *.jobsdb.com *.jobstreet.com For more info regarding @bugcrowdninja email addresses, see Bugcrowd Researcher Docs . Job Posting Guidelines When posting jobs only post jobs using the following details: Job title (must contain) : "Bugcrowd - Do Not Apply" Job location : Iceland Job ad classification : Farming, Animals & Conservation → Farm Management New hirer accounts are now subject to an automated review process. As a result, your first test job ad may be rejected. If this happens, please submit a second test job ad, which can be approved where it meets the testing requirements above. DO NOT post Premium Ads, upgrade to Premium Ads or apply for Guaranteed Hire. Rules and Advice for SEEK Pass (formerly Certsy) Use your @bugcrowdninja email address to set up a SEEK Pass account and a SEEK account, because you’ll need both accounts to test our sharing functionality. If you prefer, you can use fictional document information or images to test out the SEEK Pass verification flow. Our admin system should catch this and reject the check. After submitting a verification request, you will be prompted to share the result with SEEK. This is an oAuth flow connecting your SEEK and SEEK Pass accounts for data sharing. You do not need to be successfully verified to do this step. Focus areas We are most interested in critical vulnerabilities that allow access to customer PII data (user's profile's and CV's) or SEEK corporate data and access to SEEK's internal network. For SEEK Pass, we are most interested in critical vulnerabilities that allow access to customer PII and sensitive data (user profiles, CVs, identity documents, credential evidence, verified data, etc) or SEEK corporate data and access to SEEK’s internal network. Excluded Submission Types Availability/volumetric testing e.g.: DoS/DDoS/Network DoS Rate limiting bypass attempts Email bombing flooding Error pages ie. verbose error messages, stack traces, invalid status codes. Admin or maintenance pages ie. monitoring system login pages, pages with no sensitive information. Non-sensitive exposed API keys ie. Google Maps, Raygun. Configuration that is not directly exploitable ie. cookie flags, weak security headers, email configuration, TLS configuration, password policy, session expiration, certificate pinning. Pre-authentication account takeover vulnerabilities. Vulnerabilities caused by unpatched or unsupported software, including: browsers, mobile applications, and mobile operating systems. Mobile issues that require root access ie. credentials in Android SharedPreferences. Mobile issues that rely on the abuse or misuse of Accessibility Services. Unverified AI-generated reports (see Program Requirements). Out of Scope Use of automated tooling Customer instances are not to be accessed in any way (i.e. no customer data is accessed, customer credentials are not to be used or "verified") Use of non-bugcrowdninja email accounts Social engineering of any kind against SEEK employees or its users Third party providers and services Leaked Credentials SEEK welcomes submissions from researchers who have discovered exposed or breached credentials. If you believe you have found sensitive customer data (e.g., login credentials, API keys etc) or a way to access customer data (i.e. through a vulnerability) report it, but do not attempt to successfully validate if/that it works. SEEK reserves the right to treat each submission and any option to reward on a case by case basis. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorised in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.

API (in scope)

Developer documentation for SEEK APIs is available at https://developer.seek.com/ . Please remember to follow the program rules when testing SEEK APIs.