Unverified50% confidenceOpinionExact time
Domestic SRCs are mostly built by enterprises themselves, with considerable variation in rules, and their requirements for report format and reproduction details are often stricter than those of public bug bounty platforms (such as HackerOne).
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/22/2026
First Seen
Valid until: 1/20/2027
Sources
AI-Powered SRC Vulnerability Hunting: A Hands-On Guide to Building the Hermes Agent Workbench
bilibili八方网域-舟舟10/22/2026
Related Entities
Related Claims
UnverifiedCommon entry-level directions for SRC include medium- and low-risk vulnerabilities such as information disclosure, unauthorized access, XSS and SSRF; these vulnerabilities have low tool dependence and clear verification paths, making them suitable as practice targets.73% similarVerifiedMost domestic SRC platforms classify vulnerabilities into four levels—critical, high, medium, and low—and at certain leading internet companies, a single critical vulnerability can yield rewards of tens of thousands of yuan, while low-severity vulnerabilities may only receive point rewards of a few dozen to a few hundred yuan.68% similarUnverified基础设施配置对精确性的要求远高于普通代码，错误的安全组规则可能导致数据泄露67% similarVerifiedSRC（安全应急响应中心）是企业设立的漏洞收集平台，企业付费购买未公开的安全漏洞，安全研究者发现并提交后审核通过可获得赏金66% similarUnverifiedTracking rumor propagation involves privacy boundaries and platform rules; within what scope public content is scanned and how such data is stored and analyzed are compliance issues these companies must face.65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1085772API
curl https://kongchang.com/api/v1/knowledge/claims/1085772MCP
get_claim(id=1085772)