Scope
• One public web flow or one API workflow
• Reproduce one deep issue or document up to five smaller findings
• Steps, environment, expected vs. actual behavior, evidence, and severity
• One regression-test recommendation and one revision
• Delivery within 48 hours after the required access or sample input is available