Bounty Board

🧩 Pentest Range

🏁 CAPSTONE — NO FLAGS. You are a hunter on the Bounty Board Logistics disclosure programme. There is a written policy at /policy.md and it is binding: an in-scope list, an out-of-scope list, rate-limit rules, and a known-issues section. The application genuinely contains several issues of different severity — including one that is real, reproducible, and already disclosed, so reporting it as new is how hunters burn their credibility. Two things make this different from every other machine on the path. First, there is nothing to capture: your deliverables are a written report and a debrief of ten minutes or less, submitted through the Pentest Reporting flow on this page. Second, the out-of-scope hosts will answer you — because in the real world they do — and sending a request to one ENDS THE ATTEMPT. Read the policy before you read anything else.