TechCorp Public Bug Bounty

In scope: the hosts listed below and their APIs. Out of scope: physical, social engineering, and anything requiring a compromised employee device. Testing rules: no more than 5 requests per second, no automated scanning against /checkout, no denial of service, and no accessing data belonging to accounts you do not control. Create your own test tenants; we will not fault you for anything you do inside your own. Response targets: first response 2 business days, triage 5 business days, bounty on fix confirmation. Duplicates are decided by first reproducible report, not first submission.