Every finding.
Every decision.
On the record.
Proofline removes the black box from vulnerability disclosure. The rulebook is fixed at submission. Every decision cites the rule it applies and states its reasoning. Each report opens a Casefile whose full event history, the Proofline, is hash-chained and visible to the researcher and the project at once.
- Available
- $0
- Paid out
- $0
- Disclosures
- 0
- Programs
- 0
Programs with a public track record
You see how each project actually treats researchers before you put days into an audit.
The rigor of a real security review, enforced by the platform
Severity, remediation and integrity aren't matters of opinion here. They're mechanical, verifiable and on the record.
Severity isn't negotiated
It falls out of the program's locked impact table. The same demonstrated impact yields the same severity for every researcher, every time.
A fix you can verify
Remediation is retested against the original proof of concept. A valid finding is owed its reward whether or not the project ships the fix.
Tamper-evident by design
Every case event hashes the one before it. Anyone holding the record can prove it was never quietly edited after the fact.
Built from the problems that come up in real bounty hunting
Silent projects, vague triage, scope reinterpreted after the fact, severity talked down, private duplicates nobody could have known about. On the project side: spam, inflated severity, PoCs that don't run. These rules protect both sides without the platform becoming a black box itself.
Rules lock at submission
Every report stores the program version it was submitted under: scope, impacts, severity table, rewards, SLAs. Later edits never govern older reports.
No invisible backchannels
Anything that affects severity, eligibility, duplicates, closure or payout lives in the case record both sides can read.
Decisions require reasons
A rejection must cite the exact locked rule. A severity change must name which impact condition was or wasn't met.
48-hour final rebuttal
Before any adverse closure is final, the researcher gets one final response. The project decides again, and mediation stays available.
Private duplicates are neutral
The platform verifies an earlier report exists and predates yours, without exposing it. An unknowable duplicate never costs you reputation.
Independent mediation
Mediators see the full locked case and publish a reasoned decision. Their pay never depends on outcome or on who pays more.
No "no fix, no pay"
Projects decide whether to remediate. They don't decide whether you did the work. A valid finding stays owed even when the project chooses Won't Fix.
No token required
Rewards are paid in stablecoins. Nobody has to buy, hold or stake a token to submit, run a program, get paid, or resolve a case.
One state machine for every program
Projects can't invent their own statuses. Disputes branch into a single final rebuttal and then independent mediation.
- 01Submit
Structured report, encrypted evidence, rulebook snapshot, content hash.
- 02Acknowledge
SLA clock visible to both sides.
- 03Triage
Verify the bug and establish the concrete impact.
- 04Decide
Severity follows from the locked impact table. Reward is computed.
- 05Fix & retest
Researcher verifies the remediation.
- 06Pay
Exactly the calculated amount, with the tx hash recorded.
- 07Disclose
Staged, mutually approved disclosure. Timestamps are public even when details aren't.
The project must cite the exact rule and give a reason. A 48-hour window opens.
The researcher answers once, with evidence. It doesn't reopen the case automatically.
A neutral mediator publishes a reasoned decision on the locked case, to both parties.
You'll always know which rules apply, why a decision was made, and what evidence it was based on.
- The rulebook fingerprint is fixed at submission
- Reward calculations show every variable
- A verified disclosure résumé that's worth something beyond the payout
- Private duplicates and good-faith misses carry no strike
Structured, accountable disclosure without spam, extortion pressure or uncertainty about disclosure.
- Structured reports with mandatory PoC fields
- Progressive submission limits and reputation-weighted access
- Commit and reveal known-issue proofs that don't leak unfixed bugs
- Behavior metrics that reward responsive programs
Same evidence. Same rules. Same record.
Every finding. Every decision. On the record.