Paid for first, not for right

Cimora does not chase public bug bounties. That is a deliberate choice about where finite review capacity goes, and it is worth explaining rather than leaving to inference.

Start with the mechanic that defines the market. When two researchers report the same bug, the program pays the one who filed first and closes the other as a duplicate. The duplicate is not wrong. It is not lower quality. It arrived second. Everything downstream follows from that single rule: the payoff is indexed to submission time, not to depth of understanding.

That rule was tolerable when finding the bug was the hard part, because filing first and understanding best were roughly the same skill. They have come apart.

What cheap submissions did to the input side

Generating a plausible vulnerability report no longer requires understanding the system it describes, or the language it is written in. People now submit findings on C++ codebases having never written C++, on consensus clients whose threat model they could not state, on protocols they have not modelled. Some of those reports are correct. Enough of them are correct, often enough, that volume is a rational strategy.

Aim enough volume at a program and the duplicate rate climbs for everyone, including the researcher who spent three days actually reading it. Their reward is not reduced. It is zero, and it is zero for a reason that has nothing to do with the quality of their work.

Programs responded the way any venue floods: by pricing entry. Submission fees are a reasonable defence against spam, and we do not begrudge them. But look at what the combination produces. A researcher now pays, per submission, to enter a race they increasingly lose on timing rather than on merit — and pays again on the next one.

The second failure mode: adjudication you cannot audit

The economics are only half of it. The other half is that a rejection is final, unexplained, and unappealable in practice.

We have watched a submission come back rejected as out of scope within minutes of a program expanding that scope — faster than anyone could plausibly have read it. A follow-up asking for the reasoning went unanswered. The fee was not returned. There may well be a good explanation; the point is that there is no mechanism by which a researcher could ever obtain one.

That is not a complaint about a bad outcome. Audits produce disagreements all the time, and a client who disputes a finding is a normal and healthy part of the work. The difference is that a disputed finding in an engagement gets argued, on the record, against code both sides can read. A rejected bounty submission gets a status change.

The cost does not land on researchers

A functioning disclosure market is the cheapest way a protocol will ever learn about its own bugs. Cheaper than an incident. Cheaper than a postmortem. Far cheaper than the trust it does not get back afterwards.

So when that channel becomes noisy, slow to adjudicate and unrewarding to file into, the cost is not really paid by the researchers. They have other work. It is paid by the protocols that would have heard about a bug early and now will not. Reports that never get written do not appear in anyone's statistics, which is what makes this both hard to argue about and easy to ignore. The absence looks exactly like safety right up until it doesn't.

What we are not claiming

Bounty programs are a legitimate and useful part of the security ecosystem. They surface real bugs, they pay real money, and researchers who have built a practice inside them are doing serious work. Nothing here says otherwise.

We should also be straightforward about our own record: the findings Cimora has submitted to public programs came back as duplicates. Not rejected as wrong — duplicated. That is exactly the outcome the model is designed to produce at scale, and it is the outcome that convinced us the model is a poor fit for how we want to spend review time. Read this as a decision about allocation, not as a verdict on anyone still competing there.

Where the same hours go instead

In a scoped engagement, nobody is racing us. The scope is fixed before work starts, the code is pinned to a commit, and the question is not did someone else notice this first but is this real, and can you prove it.

So we prove it. Every high and critical finding ships with a runnable Foundry exploit against the client's own code, which either executes or does not. That is a claim a client can check in an afternoon without trusting our judgment, our tooling, or our reputation. It also removes the argument that consumes the most time in security work — whether a finding is theoretical — because a passing exploit is not an opinion.

None of that is possible in a market that settles by timestamp. A proof takes longer to build than a report, and in a race, longer is the same as losing.

The bounty model asks who was first. An audit asks whether it is true, and then demands you demonstrate it. We would rather be paid for the second question.