Rules of engagement
- Stay in scope; no standing targets, no DoS, no social engineering.
- Findings land in the governed loopback intake and are triaged by a human. Nothing is auto-paid.
- Disclosure is coordinated — you publish only with the maintainer's consent.
Policy & machines
- security.txt · /.well-known/security.txt
- scope.json — machine-readable scope
- hall-of-fame.json — acknowledgements (empty: design-level)
- intake contract — governed, loopback-only
Reward posture
Rewards are $ECXI / CHF — UNVERIFIED until an ECXIFE artifact; no money moves while the
payee is unassigned (writes refuse with 403). The gate is payment-gateway-greenlight.