{
 "generated": "2026-08-27",
 "tool": "https://github.com/agentatwork/bounty-reality-check/blob/main/deliver.js",
 "method": "deliver.js verdict per repo: reads GitHub private-vulnerability-reporting status + the bounty doc (SECURITY.md + docs/security/*). Repos gathered from six GitHub code-searches across EVM/Solana/Soroban/Sui custody+DeFi projects advertising bug bounties.",
 "verdict_legend": {
  "DELIVERABLE": "private channel + committed reward + live + no KYC",
  "CREDIT-ONLY": "committed but mainnet-deferred",
  "KYC-GATED": "committed+live but payout via Immunefi/identity/tax forms",
  "DISCRETIONARY": "soft reward \u2014 governance vote/community pool/best-effort",
  "UNREACHABLE": "no private channel \u2014 PVR off AND email-only",
  "NO-BOUNTY": "security doc with no actual reward"
 },
 "summary": {
  "UNREACHABLE": 54,
  "DISCRETIONARY": 4,
  "NO-BOUNTY": 26,
  "KYC-GATED": 6
 },
 "total": 90,
 "cash_collectible_by_permissionless_reporter": 0,
 "repos": [
  {
   "repo": "Stellabill/stellabill-contracts",
   "verdict": "DISCRETIONARY",
   "reason": "soft payout mechanism: Rewards are **at our sole discretion** until the formal program launches.",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "abokenan444/web-agent-bridge",
   "verdict": "DISCRETIONARY",
   "reason": "soft payout mechanism: We run a **community-funded bounty** with the following ranges. Payments are",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "clearclown/tirami",
   "verdict": "DISCRETIONARY",
   "reason": "reachable channel but no concrete committed-reward language",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "profullstack/coinpayportal",
   "verdict": "DISCRETIONARY",
   "reason": "reachable channel but no concrete committed-reward language",
   "pvr_enabled": true,
   "bounty_doc": "docs/SECURITY.md"
  },
  {
   "repo": "KevinDev-N/clov",
   "verdict": "KYC-GATED",
   "reason": "payout gated: on Immunefi or a comparable platform is planned to launch alongside the",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "Kubudak90/arcorapay",
   "verdict": "KYC-GATED",
   "reason": "payout gated: Until a live bug bounty exists (planned via Immunefi at mainnet T-0), reports are credited with:",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "MetroLogic/fluxapay_contract",
   "verdict": "KYC-GATED",
   "reason": "payout gated: | **MerchantRegistry** | `fluxapay/src/merchant_registry.rs` | Merchant registration, KYC tiers, volume caps, tier auto-upgrades |",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "MystenLabs/sui",
   "verdict": "KYC-GATED",
   "reason": "payout gated: -   Once a bug report is accepted as legitimate, assuming KYC has been completed successfully, bounties will be paid out on or about a time",
   "pvr_enabled": true,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "SwellNetwork/v3-core-public",
   "verdict": "KYC-GATED",
   "reason": "payout gated: For more details please use this link: [Swell Bug Bounty](https://immunefi.com/bounty/swell/)",
   "pvr_enabled": true,
   "bounty_doc": "bug-bounty.md"
  },
  {
   "repo": "prsm-network/PRSM",
   "verdict": "KYC-GATED",
   "reason": "payout gated: When live, payout scale follows Immunefi conventions:",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "Ande-Labs/KhipuVault",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "AngleProtocol/angle-docs",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "Bonzo-Labs/bonzo-docs",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "Diederick95/test",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "FilecoinFoundationWeb/filecoin-foundation",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "MythFinance/docs.myth.finance",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "Neocryptoquant/market-maker-studies",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "NonceGeek/scaffold-sui-based-on-AI",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "Premian-Labs/premia-v2-docs-gitbook",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "Sanmit498/RoliMint",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "VAD37/security-research-archive",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "ajaysenr/HackerOne-Disclosed-Reports",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "dcorps-hub/dcorps-docs-public",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "de-snake/docs-knowledge-fork",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "flayerlabs/flaunch-gitbook",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "gnosischain/documentation",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "iliyami/MEV",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "mintlify-atlas/docs-atlas-14bfd208",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "mintlify-atlas/docs-atlas-7164c086",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "oak-network/docs",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "otter-sec/anchor-community",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "scallop-io/docs",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "scroll-tech/scroll-documentation",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "sushmitsarmah/sushmit.Q1.Sui.PreR",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "velocity-exchange/velocity-docs",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": true,
   "bounty_doc": "none"
  },
  {
   "repo": "vuneumaaa/AAIP",
   "verdict": "NO-BOUNTY",
   "reason": "no SECURITY.md / bug-bounty doc found",
   "pvr_enabled": false,
   "bounty_doc": "none"
  },
  {
   "repo": "0dotxyz/marginfi-v2",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "AdekunleBamz/stakeforge",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "Aurigami-Finance/aurigami-smart-contracts",
   "verdict": "UNREACHABLE",
   "reason": "no private reporting channel found (PVR off, no security email)",
   "pvr_enabled": false,
   "bounty_doc": "bug-bounty.md"
  },
  {
   "repo": "BacBacta/SwapPilot",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "Cyfrin/2024-10-sablier",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "Dr-SoloDev/ginva",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "docs/SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "ExpertVagabond/mango-v4",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "mx1.privateemail.com",
   "mx_class": "OTHER-MX (deliverability untested, plausible)",
   "committed_reward": true
  },
  {
   "repo": "FTHTrading/UnyKorn-X402-aws",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "GainJar-Payroll/gainjar",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (addresses redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "Jac0xb/lighthouse",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": false
  },
  {
   "repo": "Kartikvyas1604/VeilPool",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "KudiArc/kudi-arc",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "mx1.privateemail.com",
   "mx_class": "OTHER-MX (deliverability untested, plausible)",
   "committed_reward": false
  },
  {
   "repo": "Medialordofficial/tavsin",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": false
  },
  {
   "repo": "MerkleMint/Atomic-IP-Marketplace",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": false
  },
  {
   "repo": "Moony6789/moonbeam_pro",
   "verdict": "UNREACHABLE",
   "reason": "no private reporting channel found (PVR off, no security email)",
   "pvr_enabled": false,
   "bounty_doc": "bug-bounty.md"
  },
  {
   "repo": "NARAProtocol/nara_protocol_v4_baskets",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "mx1.hostinger.com",
   "mx_class": "OTHER-MX (deliverability untested, plausible)",
   "committed_reward": false
  },
  {
   "repo": "Pamenarti/wormhole-fork",
   "verdict": "UNREACHABLE",
   "reason": "no private reporting channel found (PVR off, no security email)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "PrediX-Protocol/predix-contracts",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "The-Social-Proof-Foundation/mys-core",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (addresses redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "alt1.aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "UmutKorkmaz/lessonblinks",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "docs/SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": false
  },
  {
   "repo": "Vishal-770/mecha-pay",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (addresses redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "aagoldberg/far-mca",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "aangneo7/emy-network-protocol",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": false
  },
  {
   "repo": "achen54/boba",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "bug-bounty.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": false
  },
  {
   "repo": "aethelred-foundation/aethelred",
   "verdict": "UNREACHABLE",
   "reason": "invitation-only / not-open program: Aethelred currently operates a **private, invitation-only protocol bug bounty**",
   "pvr_enabled": true,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "mx1.hostinger.com",
   "mx_class": "OTHER-MX (deliverability untested, plausible)",
   "committed_reward": false
  },
  {
   "repo": "alrimarleskovar/RoundFinancial",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted) [gmail \u2014 reputation-walled from a fresh sender]",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "gmail-smtp-in.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": false
  },
  {
   "repo": "antefinance/ante-v05-core",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "bug-bounty.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "blockworks-foundation/autobahn",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "blockworks-foundation/mango-v4",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "bobanetwork/boba_legacy",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "bug-bounty.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": false
  },
  {
   "repo": "dankerboyz/suinetwork",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (addresses redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "dikipidorot/AggreMax-marginfi_yield_cpi_integration",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "everscale-org/bounties",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "mx2.hostinger.com",
   "mx_class": "OTHER-MX (deliverability untested, plausible)",
   "committed_reward": false,
   "committed_reward_note": "corrected 2026-08-27: was true (false positive); see triage_note",
   "triage_note": "Triaged 2026-08-27: NOT an auditable target \u2014 repo is a bounty-listing board (README+SECURITY.md only, no contract code, last pushed 2023-09-10). 'committed_reward' fired on the program advertisement, not on a payable code finding."
  },
  {
   "repo": "filecoin-project/community",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (addresses redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "fyxvo/fyxvo-platform",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "inbound-smtp.eu-west-1.amazonaws.com",
   "mx_class": "OTHER-MX (deliverability untested, plausible)",
   "committed_reward": false
  },
  {
   "repo": "joshlevylabs/agent-commerce-protocol",
   "verdict": "UNREACHABLE",
   "reason": "no private reporting channel found (PVR off, no security email)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "mushroomsforest/deployment",
   "verdict": "UNREACHABLE",
   "reason": "no private reporting channel found (PVR off, no security email)",
   "pvr_enabled": false,
   "bounty_doc": "security.md"
  },
  {
   "repo": "omgnetwork/boba-docs",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "bug-bounty.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": false
  },
  {
   "repo": "one-chain-labs/onechain",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (addresses redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "alt2.aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "paraloom-labs/paraloom-core",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "route3.mx.cloudflare.net",
   "mx_class": "OTHER-MX (deliverability untested, plausible)",
   "committed_reward": true
  },
  {
   "repo": "pickle-finance/protocol",
   "verdict": "UNREACHABLE",
   "reason": "no private reporting channel found (PVR off, no security email)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "porter-finance/audits",
   "verdict": "UNREACHABLE",
   "reason": "no private reporting channel found (PVR off, no security email)",
   "pvr_enabled": false,
   "bounty_doc": "bug-bounty.md"
  },
  {
   "repo": "proxyo1/quay",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "mx.zoho.com",
   "mx_class": "OTHER-MX (deliverability untested, plausible)",
   "committed_reward": false,
   "committed_reward_note": "corrected 2026-08-27: was true (false positive); see triage_note",
   "triage_note": "Triaged 2026-08-27: real unaudited Sui Move code (payments.move) BUT SECURITY.md states 'No bug bounty until post-mainnet. Targeted Immunefi-tier-1 program planned ($10k starter pool).' The dollar figures deliver.js read as committed were an audit-cost estimate ($25-50k) and a planned future pool \u2014 neither is a reporter payout. Real reward is KYC-gated + post-mainnet."
  },
  {
   "repo": "raydium-io/raydium-amm",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": false
  },
  {
   "repo": "raydium-io/raydium-clmm",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": false
  },
  {
   "repo": "raydium-io/raydium-cp-swap",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": false
  },
  {
   "repo": "retrovaliks/magnifi-v2",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "robodynexyz/robodyne",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": null,
   "mx_class": "NO-MX (dead contact \u2014 undeliverable by anyone)",
   "committed_reward": true
  },
  {
   "repo": "sendaifun/fraction",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "shaokun11/move-sui-me",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (addresses redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "alt1.aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "vatsalm30/ETHDenverProject",
   "verdict": "UNREACHABLE",
   "reason": "no private reporting channel found (PVR off, no security email)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md"
  },
  {
   "repo": "verichains/sui-revela",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (addresses redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "alt2.aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "welldonestudio/sui-explorer",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (addresses redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "aspmx.l.google.com",
   "mx_class": "GOOGLE (blocked from this low-rep box)",
   "committed_reward": true
  },
  {
   "repo": "wienerlabs/mosaic",
   "verdict": "UNREACHABLE",
   "reason": "no PVR; submission is email-only (address redacted)",
   "pvr_enabled": false,
   "bounty_doc": "SECURITY.md",
   "contact_email": "[redacted]",
   "contact_mx": "mx-01.kurumsaleposta.com",
   "mx_class": "OTHER-MX (deliverability untested, plausible)",
   "committed_reward": false
  }
 ],
 "unreachable_mx_breakdown": {
  "GOOGLE (blocked from this low-rep box)": 22,
  "NO-MX (dead contact \u2014 undeliverable by anyone)": 15,
  "OTHER-MX (deliverability untested, plausible)": 9
 },
 "note": "UNREACHABLE means deliver.js found no private channel (PVR off) and only an email contact. This enrichment resolves each email domain's MX: 'NO-MX' contacts route nowhere and are undeliverable by anyone; 'GOOGLE'/'MICROSOFT' are deliverable in principle but reject mail from this low-reputation box; 'OTHER-MX' (Zoho/Hostinger/Namecheap/Cloudflare/SES) are untested and plausibly accept mail from a reputable sender. Repos with committed_reward=true AND an OTHER-MX contact are the only email-only rows that could plausibly convert.",
 "correction_2026_08_27": "The two OTHER-MX repos previously flagged as committed+deliverable leads (everscale-org/bounties, proxyo1/quay) were triaged and both collapse: the first has no auditable code; the second explicitly defers its bounty to a post-mainnet Immunefi program. deliver.js classifier limitation surfaced: dollar amounts that are audit-cost estimates or planned future pools false-trigger committed_reward. Net genuinely-new payable leads from the 90-repo batch: 0.",
 "redaction": "Contact addresses are redacted for every repository in this dataset, not selectively. A later survey (notes/hijackable-contacts) found that some security-contact domains are unregistered and therefore claimable by anyone, which turns a published address into an interception target. Redacting only the affected entries would identify them by omission, so all are redacted. The verdicts, which are what this dataset measures, are unchanged. Repository names are retained: 6 of these 90 repos also appear in the unregistered-domain set, a 6.7% rate against an 8.8% base rate in a generic SECURITY.md corpus, so the list is no more enriched than picking repos at random and offers an attacker nothing. The addresses were the whole enrichment, and they are gone.",
 "correction_2026_08_27b": "Redacted all contact addresses. This artifact predates the redaction rule adopted after the hijackable-contacts survey; it had published four unregistered contact domains."
}