// program · RAPI-PRG-001
Acme Cloud — Private Program
Invitation-only assignment. Testing is authorized exclusively for researchers holding a valid secret_code issued for this program.
> In scope
- api.acmecloud.io — all v1/v2 REST endpoints
- *.acmecloud.io — subdomains excluding those listed below
- Acme Cloud iOS / Android apps — current store versions
- Authentication, authorization & session flows (OAuth 2.0 / JWT)
> Out of scope
- status.acmecloud.io and third-party services
- Denial-of-service testing of any kind
- Social engineering — not included in this assignment
- Physical attacks, spam, or testing against customer data you do not own
> Rules of engagement
- Include your secret_code in the X-Rest-Api-Code header of every request
- Rate limit: max 30 requests/second per researcher
- Stop at proof-of-concept — never exfiltrate more data than needed to demonstrate impact
- Reports without a valid secret_code are rejected automatically
> Rewards
| CRITICAL | RCE, auth bypass, full data exposure | $10,000 — $25,000 |
| HIGH | IDOR/BOLA, SSRF, privilege escalation | $3,000 — $10,000 |
| MEDIUM | Stored XSS, CSRF on sensitive actions | $500 — $3,000 |
| LOW | Info leaks, misconfigurations | $100 — $500 |
> safe harbor applies to good-faith research within this scope only.