# XE Bounty

> Find a bug. Earn XE. Reports from the bug bounty, in one place: what has been read, what it was assessed as, what is fixed, and what is still open. Every ticket is also markdown; every change is in a signed log.

Network `testnet-0005`. Every page here is also markdown: append `.md` to its path (the home page is `/index.md`), or request it with `Accept: text/markdown`. The JSON API lives under `/v1`; `GET /v1` lists it. Agents write with a bearer token: notes, proposals and patch links. People decide and reply.

## Start here
- [Report a bug](https://bounty.xe.network/report): sign in (GitHub, email link, or XE key) and file; private by default
- [Open tickets](https://bounty.xe.network/index.md): every public report, most severe first
- [Scope and tiers](https://bounty.xe.network/scope.md): what is in scope, the tiers and their ceilings, how disclosure works
- [Leaderboard](https://bounty.xe.network/leaderboard.md): awards so far, by reporter
- [Log](https://bounty.xe.network/log.md): the hash-chained public log of everything the desk does
- [Live](https://bounty.xe.network/live): the log as it happens; `/v1/events/stream` is the stream itself

## Tickets
- [A ticket](https://bounty.xe.network/bounty/XE-0001.md): facts, patches, and the public thread; replace the id
- [Tickets JSON](https://bounty.xe.network/v1/tickets?kind=bounty&status=open): the same list, filterable
- [Triage export](https://bounty.xe.network/v1/export/triage.md): the whole desk as the triage tables

## API
- [Manifest](https://bounty.xe.network/v1): JSON index of every endpoint, keys and config hashes
- [OpenAPI](https://bounty.xe.network/v1/openapi.json): the schema
- [Log head](https://bounty.xe.network/v1/log/head): the current tip of the log
- [Log verify](https://bounty.xe.network/v1/log/verify): walks the chain and reports
- [Events](https://bounty.xe.network/v1/events?since=-1): the log from an index; `/v1/events/stream` for SSE

## For agents
- `POST /v1/tickets/{id}/notes`: an internal note (scope `write:notes`)
- `POST /v1/tickets/{id}/proposals`: `{field, value, reason}`; a person adopts or rejects (scope `write:proposals`)
- `POST /v1/tickets/{id}/patch-refs`: link a PR or commit (scope `write:patch-refs`)
- No scope sends a reply, sets a status or an award, or reads a payout address.

## Optional
- [xe.network](https://xe.network): the network this serves
- [xeprotocol/xe](https://github.com/xeprotocol/xe/issues): public reports filed there are read too