{
  "bounty": {
    "name": "THIRE / Cipherbit bug bounty",
    "status": "design-level, HOLD by default",
    "policy_url": "/bounty.html",
    "intake": "loopback-only POST /api/bounty/intake (HOLD + UNVERIFIED)",
    "gate": "payment-gateway-greenlight",
    "payee": "unassigned — money writes refuse (403)",
    "currency_note": "$ECXI / CHF UNVERIFIED until ECXIFE artifact",
    "no_standing_targets": true
  },
  "scope": [
    {
      "id": "T-01",
      "target": "https://thire.co",
      "nature": "public read-only console + landing",
      "limit": "read-only; legitimately public routes only"
    },
    {
      "id": "T-02",
      "target": "https://cipherbit.ai",
      "nature": "estate gateway + public pages",
      "limit": "public pages and gateway quote surface; no admin paths, no loopback-only services"
    },
    {
      "id": "T-03",
      "target": "https://cipherbit.ai/.well-known/security.txt",
      "nature": "disclosure surface",
      "limit": "no disruptive scanning"
    }
  ],
  "out_of_scope": [
    "loopback-only services (127.0.0.1) and internal relays",
    "managed provider infrastructure (OCI, oriented.net, hosting control planes)",
    "social engineering, DoS, physical access, tenant data without authorization"
  ],
  "reward": {
    "ranges": ["$ECXI (UNVERIFIED) for reproducible eligible findings"],
    "disclosure": "coordinated; vulnerability is public only with maintainer consent"
  }
}