Open-source bug bounties for the AI era
AI slop killed open-source bug bounties. Good Faith brings them back.
Free reports stay free. Claiming a bounty takes a refundable $20.00 PayPal hold. Claude reproduces the report against a sandboxed copy of the project before anyone pays: real finds are paid in minutes, and fabricated ones pay for the maintainers' time.
Bounty claim
$20.00 PayPal authorization hold
Claims · version · cited code · duplicates · sandbox replay · verdict
What broke
Two of open source's best-known bounties stopped in 2026.
21 Jan 2026curl ended its bug bounty
“Remove the incentive for people to submit crap and non-well researched reports to us. AI generated or not.”
Daniel Stenberg, curl maintainer
The Register: “Curl shutters bug bounty program to remove incentive for submitting AI slop”3 Apr 2026The Internet Bug Bounty paused new submissions
“The balance between findings and remediation capacity in open source has substantively shifted.”
HackerOne, which runs the IBB
InfoWorld: “Internet Bug Bounty program hits pause on payouts”AI-assisted research finds real bugs too. What broke bounties is the cost of claims nobody can verify. Good Faith makes every claim checkable, and every fabricated one costly.
How it works
Proof first, then money. And only a person moves the money.
- 01
Report, or claim a bounty
Anyone can report for free. A bounty claim posts a $20.00 authorization hold with PayPal: a hold, never a charge, unless a human confirms slop.
- 02
Claude triages, as untrusted data
It checks every cited file and function exists at the claimed version, dedupes against verified reports, and flags instructions aimed at itself.
- 03
The PoC runs in a sandbox
A fresh, network-isolated Lantern seeded with canary secrets. A canary reaching the wrong account is proof, not an opinion.
- 04
A maintainer settles
Pay (the hold is voided, the bounty sent with PayPal Payouts), release, or capture. Each deposit resolves exactly once.
Live from the Lantern program
Every report, verdict and dollar, counted.
Reports triaged
6
6 received
Reproduced
33%
2 with proof
Slop caught
3
1 duplicates, 0 for humans
Deposits captured
$60.00
3 · 3 released
Bounties paid
$1,000.00
2 payouts
Median time to triage
12 s
deposit held to verdict
Built on PayPal
Each step is a PayPal primitive, used for what it is good at.
Idempotent by construction: every money call carries a fixed PayPal-Request-Id, and the payout's sender batch id is the report id.
- Orders v2 · AUTHORIZE
- The bounty-claim deposit: a hold the researcher approves.
- JS SDK v6
- The PayPal button, with a browser-safe client token.
- Payments v2 · void
- Release: honest reports get every cent back.
- Payments v2 · capture
- Slop: the hold becomes the maintainers' fund.
- Payouts
- The bounty, paid once per report id.
- Orders v2 · CAPTURE
- Sponsors fund the bounty pool.
- Webhooks, verified
- Holds, voids, captures and payouts reconcile.
- Claude
- Triage with tools; deterministic policy decides.
Free reports stay free. Good-faith research gets paid. Slop pays for itself.