amazon bug bounty xss proof