BiteCo (biteco.one) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

BiteCo routes user sessions through apps and APIs, emits signed webhooks, enforces tenant or org boundaries, proxies partner callbacks, caches HTML/JS at the edge, and schedules jobs that mutate user-visible state — fertile ground for broken access control, cross-tenant leaks, and silent state corruption if any boundary slips. This playbook rewards only highest-impact, fully demonstrated criticals — each earns $5,000.

In scope materially: every HTTP(S) origin answering for biteco.one and delegated subdomains, WebSocket channels they operate, databases and object stores their workers touch, signing keys they custody for Bearer/HMAC flows, preview or staging shards they label, observability paths they operate, SDK loaders or deep links they document.
Civil exclusions only: mass harassment, ransomware against unrelated third parties, laundering. Not product carve-outs.

There is exactly one bounty amount that maps to payouts on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows must exhibit (a) attacker-readable kill-chain storytelling and (b) objective proofs of successful exploitation replayable by BiteCo responders (Burp transcripts, scripted API sequences, SSRF egress captures, signing-bypass traces…).

These rows do not impose limits — shorthand for tagging reports. Anything BiteCo hosts, signs, proxies, caches, verifies, or webhook-delivers counts as bounty ground even if undocumented here. Treat “not listed” ≠ “out-of-scope”: default stance is open scope across BiteCo.

This playbook refuses “only these SKU endpoints.” Sandbox shards, mirrored tenants, Grafana boards, feature-flag planes, SMTP bridges, automation hooks BiteCo patches — all bounty eligible when critical impact is reproducible.

• Every apex / vanity hostname routing through BiteCo edge — claim routing evidence in your chain write-up.
• Infrastructure-as-code or client SDK repos BiteCo ships toward production
• Edge workers or bundles they sign & serve to browsers
• Partner OAuth or API-key consent surfaces BiteCo operates

1. Prove exploitation success. Ship artefacts third parties rerun: scripted curl flows, Burp/HAR exports, SSRF egress captures, signing forgery scripts with verified callback acceptance.
2. Articulate kill chain granularity. Number each hop: auth boundary → abused endpoint → escalation → monetizable damage (ATO, cross-tenant bleed, silent reroute, infra takeover…).
3. Responsible blast radius documentation. Quantify users or orgs affected even when exercised only on staging mirrors that mirror routing + auth faithfully.
4. Encrypt & ship privately. Use sanctioned intake on biteco.one (see submit section) before broadcasting exploit details.
5. Honor duplicate fairness. First fully qualifying chain + reproducible exploitation wins treasury on collisions.

Start from the security / disclosure contact publicly listed on biteco.one (security@biteco.one is a common pattern — verify on the vendor site before sending). Mandatory sections mirror below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — impact in one paragraph

# Severity self-classification → must map to BiteCo critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions (session / API key / org context)
2. Entry primitive — exact HTTP verb/path/query/body
3. Pivot(s) chaining trust escalation
4. Final hop → ATO / cross-tenant damage / reroute / infra takeover equivalent

## Successful exploitation evidence
• Replayable script + truncated responses showing impact
• HAR / Burp with unauthorized state change
• Webhook or worker logs proving forged delivery accepted

## Reproduction package
Commands + fixtures + pinned SHAs

## Disclosure ack
Responsible channel only until BiteCo clears publication coordination

Pseudocode for API requests without a key still reaching handlers — useless without traces proving unauthenticated biteco.one calls mutate protected state.

// BUGGY: missing / invalid API key maps to a synthetic admin tenant
function attachTenant(req, res, next) {
  const key = req.header('X-Biteco-Key');
  if (key && registry.has(key))
    req.tenant = registry.get(key);
  else
    req.tenant = { id: 'public', role: 'admin' }; // default-overprivileged
  next();
}