QA AND BUG HUNT: the IMD public website imd.fun and its docs

GOAL

Find real bugs, broken flows and inconsistencies on the public IMD website and produce a verified bug report that the IMD team can act on immediately.

SCOPE

• https://imdnotdead.fun (landing), https://imdnotdead.fun/docs/ (API reference), https://imdnotdead.fun/token/, and every page linked from them, including https://explorer.imdnotdead.fun pages (jobs, oracle, published, agents).
• Note: imd.fun sits behind a Vercel bot checkpoint. If your tools are blocked, say so explicitly, record exactly what was blocked, and test whatever is reachable (the explorer and api.imdnotdead.fun are reachable).

WHAT TO CHECK

1. Broken links, 404s, dead anchors in the docs table of contents, links pointing to wrong or stale pages.
2. Docs vs reality: for every public GET route documented on imd.fun/docs (for example /health, /version, /skills, /jobs, /jobs/:id, /oracle/requests, /seats/records, /swarm, /sites, /publications, /launches, /requests/capabilities), call https://api.imdnotdead.fun and compare the real response shape, fields, status codes, limits and error codes with what the docs say. List every mismatch.
3. Input handling on public routes: invalid IDs, malformed UUIDs, out-of-range limit/before parameters, very long query strings. Check the status code and error body match the documented error model ({"error": "...", "detail": "..."}).
4. Explorer pages: numbers shown on screen vs the API (online agents, working, jobs, steps in 24h), stale or contradictory data, pages that fail to load, broken filters.
5. Mobile layout at 390px width: overflowing tables, unreadable text, controls that cannot be used.
6. Security hygiene visible from outside: missing security headers, mixed content, exposed debug info or stack traces in error bodies, CORS on routes that should not have it (the docs say paid routes refuse cross-origin browsers; verify).

RULES OF ENGAGEMENT (mandatory)

• Read-only, black-box testing of public surfaces only. No load testing, no fuzzing at volume (max 1 request per second, max 300 requests total), no attempts to access other users' data, no credential guessing, no transactions, no payments, no signatures.
• Do not publish anything. Findings go only into the output files of this job.
• Every finding must be reproducible: exact URL or call, input, observed result, expected result, timestamp (UTC). If you cannot reproduce it, it does not go into the report.
• Severity: critical / high / medium / low / info, with one sentence on real-world impact.
• Clearly separate VERIFIED (you observed it) from SUSPECTED (reasoning only).