Introduction

Proofline is a security coordination platform for bug bounties and audit competitions. It exists because researchers and projects keep running into the same problem: the decisions that decide a report's outcome (scope, severity, duplicates, closure, payment) are made in places the other side can't see.

Proofline is built on one principle:

The rules, evidence, communication, decisions and payout obligations that affect a vulnerability report are visible and auditable by both sides.

#What that means in practice

• Rules lock when you submit. Every report is bound to the exact program version that was live at submission, with its scope, impacts, reward table, SLAs and policies. A project can publish new versions, but they never apply to older reports.
• Decisions require reasons. A project can't just click Rejected. It must cite the specific locked rule it relies on and explain why it applies.
• Everything is on the record. Each report becomes a Casefile. Every event on it is appended to its Proofline, a hash-chained history that neither side can quietly edit.
• Disputes have a fair path. Before any adverse closure is final, the researcher gets one final rebuttal within 48 hours. If the project upholds its decision, an independent mediator reviews the locked case and publishes a reasoned decision.
• A valid finding is a payout obligation. A project can decide not to fix something, but that never cancels an earned reward.

#Who it's for

#Same evidence. Same rules. Same record.

Researchers always know which rules apply to their report, why a decision was made, and what evidence it relied on. Projects get structured, reproducible reports without spam, extortion pressure or uncertainty about disclosure.