tl;dr<p>a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie&#x2F;token being hidden, but present in the HTML code.<p>also, there is no bug bounties for the tarsnap website, only for tarsnap code.