vulns.co
/
GKData.io MCP

HackerOne · 2 min read

Arc

Paid Bounty

Open current program Reviewed policy

What this record establishes

Reviewed policy

An individually reviewed public policy is linked to this program page.

Read the reviewed policy profile →

Directory row 7; Active program checkbox checked; Bounties minimum displayed $100. Positive displayed minimum supports paid bounty listing. Policy and live submission availability unverified.

Published asset scope

Snapshot captured 2026-10-03. Scope status: Captured.

In scope · 6 published rows
AssetTypeGroup / eligibility
*.arc.ioWILDCARDBounty eligible: Yes
rpc.testnet.arc.networkURLBounty eligible: Yes
rpc.drpc.testnet.arc.networkURLBounty eligible: Yes
https://github.com/circlefin/malachiteSOURCE_CODEBounty eligible: Yes
https://github.com/circlefin/arc-nodeSOURCE_CODEBounty eligible: Yes
https://github.com/circlefin/arc-remote-signerSOURCE_CODEBounty eligible: Yes
Out of scope · 3 published rows
AssetTypeGroup / eligibility
community.arc.ioURLBounty eligible: No
explorer.arc.ioURLBounty eligible: No
help.arc.ioURLBounty eligible: No

Capture limits

  • This Arc is Circle’s financial-platform program, not a browser product. Policy displays September 16, 2026; reward table displays September 14, 2026.
  • Only dollar notation was established, so ISO currency and normalized numerical bounds remain null. The exceptional $1,000,000 category is separate from the ordinary $200,000 critical ceiling.
  • The reviewed updates page explicitly displayed no updates. Linked policy and reward revision archives and authenticated submission flow were not reviewed.
  • The policy both lists examples of low-tier rewards and excludes similar low-impact categories elsewhere. Eligibility depends on concrete impact and the full live terms; this summary does not resolve that tension.
  • Asset inventories and operational instructions are intentionally omitted. No account was created, report submitted or target tested; this record grants no testing permission.
  • Published structured-scope rows were captured. Submission eligibility and bounty eligibility differ; program policy text may add restrictions.

Live policy and platform eligibility still require review.

Sources and collection identity

  1. Official program page Primary source · reviewed 2026-10-03
  2. Published scope source Primary source · reviewed 2026-10-03

Appears in Discovery, Bounty, Profile. No identity match is inferred from a shared company name.

GitHub snapshot 2026-10-04

53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software