Bug bounty triage
You run the bounty. We tell you which reports are real.
What it is
A public bounty programme produces a flood. Most submissions are duplicates, out of scope, automated scanner output or plain wrong, and each still demands a technically credible answer within a day or two or the researcher goes public.
We do not run a bounty platform, and we will point you at an established one. What we sell is the judgement layer on top: reproducing what comes in, grading severity against your own system, and telling you what to pay.
What we examine
- Every submission reproduced independently, not judged from the description.
- Severity graded against your architecture and real impact, not a generic matrix.
- Duplicates and out-of-scope reports closed with a technical reason the researcher accepts.
- Payout recommendation per valid finding, consistent across the programme.
- Remediation guidance attached to each confirmed report.
- Escalation path for anything critical: you hear about it in hours, not on the next report.
- Programme scope and rules reviewed up front, since most disputes start there.
What you get
A verdict per submission: valid, duplicate, out of scope or invalid, with reasoning.
A reproduction for every confirmed finding, so your engineers start from a working case.
Consistent payout recommendations that hold up when a researcher argues.
Periodic programme review: what the submissions reveal about your weak areas.
How the engagement runs
- 01
Scope
Programme rules, severity matrix and escalation path agreed. Fixed monthly fee or per report.
- 02
Receive
Submissions come to us from your platform of choice, with SLAs on first response.
- 03
Reproduce
Each one tested independently. Anything critical escalates immediately.
- 04
Recommend
Verdict, severity and payout, with the reasoning attached for the researcher.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
Do you run the bounty platform?
No. Established platforms already have the researcher communities, and building a rival would take years. We integrate with the one you choose and sell the part that needs judgement.
Which platform should we use?
Depends on your stack and budget, and we will give you a straight recommendation with no referral arrangement behind it.
Can you triage if we already have an internal team?
Yes, commonly as overflow or as a second opinion on disputed reports, where an independent verdict settles an argument faster than an internal one.
Does a bounty replace an audit?
No. A bounty pays for what someone happens to find; an audit is systematic coverage of a defined scope. Programmes launched without an audit mostly generate expensive reports about things a review would have caught in week one.
Often bought with
Web3 and protocol audit
Line-by-line review of contracts, chain layer and upgrade paths, with proof-of-concept for every finding.
Monitoring and incident retainer
Continuous on-chain monitoring with automated response, and a team on call when something moves.
Penetration testing
Web, mobile, API, cloud and key infrastructure tested the way a real intruder would.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote