Won't Fix
Declining to remediate is your call. Declining to pay for valid work isn't.
Sometimes the right engineering decision is not to fix a finding: the deployment is being migrated, the architecture makes a fix impractical, or you accept the risk. Proofline supports that decision. It just doesn't let it rewrite whether the researcher did the work.
Three separate questions
| Question | Decided by |
|---|---|
| Is the finding valid, and at what severity? | Evidence against your locked rules |
| Is a reward owed, and how much? | Your locked reward table |
| Will you remediate? | You |
Recording Won't Fix
On an accepted Casefile, choose Won't fix, pick a reason and explain it (the researcher sees it):
- Architectural constraint
- Deployment being migrated or deprecated
- Risk accepted
- Depends on a third party
- Other
The case moves straight to Payout pending, and the payout SLA starts. The decision is recorded on the Proofline and in the Decision ledger, and your track record shows a public count of Won't fix (reward still owed).
There's no "No Fix, No Pay"
Some platforms let projects avoid paying when they decide not to fix. Proofline doesn't. Once a finding is established as valid, in scope and meeting its impact, the reward is an obligation under the locked program rules. With an on-chain vault, the researcher can claim it directly once the payout SLA passes.
Disclosure
Won't Fix findings stay private: they aren't disclosed or listed on public profiles, because the vulnerability is still live.