Private programs, VDPs and Safe Harbor
Invite-only programs ranked by verified impact, recognition-only disclosure programs, and SEAL Safe Harbor adoption.
Private (invite-only) programs
A private program is invisible to anyone who isn't invited. It isn't listed in the directory, and its pages return not found, so even its existence stays confidential.
- Invite by handle, or from suggestions ranked by Proof score. You can filter by minimum level (Contributor, Specialist, Expert…) and by verified identity. Researchers with spam outcomes are never suggested.
- Invited researchers can review the full rulebook before accepting. They can submit only after they accept, and the server enforces this, not just the UI.
- Revoking access removes the program from the researcher's view. It never touches Casefiles they've already submitted; those remain theirs.
- On public researcher profiles, findings from private programs show as Private program, with no name, link, title or acknowledgement text.
Switch between public and private at any time in Program builder → Access.
Vulnerability disclosure programs (VDP)
A VDP pays recognition instead of money: valid findings get a verified acknowledgement and credit on the researcher's Proofline profile. Everything else works the same way: locked rules, decisions with reasons, the 48-hour rebuttal, mediation, and staged disclosure.
Choose Disclosure program (VDP) as the starting rulebook when creating a program. The directory and program page show Recognition in place of a bounty amount.
SEAL Whitehat Safe Harbor
Programs can adopt the SEAL Whitehat Safe Harbor agreement. It pre-authorizes whitehats to rescue funds during an active exploit, for a bounty share of what they recover (for example, 10% up to a cap).
Adoption is part of the locked rulebook, so researchers can rely on it for every report under that version. Set it in Program builder → Policies, including a link to your on-chain registration or governance adoption. Programs that have adopted it show a Safe Harbor badge.
Safe Harbor covers in-progress exploits only. Ordinary vulnerability reports still go through the normal bounty process.