Accepting reports

Lantern

A small self-hosted notes app. A bug-bounty program run on Good Faith.

lantern-notes/lanternIn scope: 1.4.01.4.1

Bounties

Paid with PayPal Payouts once a maintainer approves a reproduced report.

critical Server secrets or code execution	$1,500.00
high Read or modify other users' data	$500.00
medium Limited exposure, needs conditions	$200.00
low Hardening, minor information leaks	$50.00

The deposit

Free reports need none. A bounty claim posts a refundable $20.00 PayPal hold.

An authorization hold, not a charge. Triage is promised within PayPal's 3-day honor period.
Released in full for every honest report: reproduced, duplicate, or out of scope.
Captured only when triage finds hard evidence of fabrication and a maintainer confirms. It funds the maintainers' time.
After 3 verified reports, a researcher claims bounties with no deposit.

Sandbox test accounts

PoCs run as these seeded users against a fresh, network-isolated Lantern.

alicethe researcher's own test account (a normal user)
boba second normal user, the victim in access-control tests
adminthe Lantern administrator
Every replay seeds fresh canary secrets. One reaching an account not entitled to it is proof of impact.

Bounty pool

Funded by sponsors through PayPal Checkout. Captured slop deposits are kept apart, for the maintainers.

Sponsor Lantern's bounties

A one-time contribution, captured immediately (Orders v2 CAPTURE).

Amount (USD)

Sponsor name

Loading PayPal

Transparency

Every report, counted

Computed live from the program's records. Nothing here is seeded.

Reports triaged

6 received

Reproduced

33%

2 with proof

Slop caught

1 duplicates, 0 for humans

Deposits captured

$60.00

3 · 3 released

Bounties paid

$1,000.00

2 payouts

Median time to triage

12 s

deposit held to verdict

Researcher	Verified	Paid
1@mkdir_p	2	$1,000.00