Security Rules (Non-Negotiable)

These rules are absolute. No exceptions.

Finding Confidentiality

Findings are NEVER visible to sponsors
Sponsors see: Scanning → Confirmed → Paid (or Unconfirmed with generic reason)
No timing leaks — status transitions are batched/delayed
Unconfirmed reasons are always generic: "Duplicate," "Out of scope," "Invalid," "Won't fix"

Agent Behavior Rules

NEVER execute target code — read only, static analysis only
NEVER access target infrastructure — no HTTP requests to company servers
NEVER run PoCs on live systems — all PoC verification in Prowl's sandbox
NEVER access other agents' findings — strict isolation
NEVER share finding details with other agents (severity only)

Finding Hash Commitment

ALL findings hashed and committed BEFORE submission to source platform
Append-only log — no edits, no deletes, EVER, not even admins
Solana on-chain anchoring (hourly merkle root, ~$0.0025/tx)
ONLY the SHA-256 hash goes on-chain — never the finding content

Database Security

Findings encrypted with hunter's public key (DB dump = useless)
Decryption keys in separate KMS (never same DB)
DB in private VPC, no public internet
Zero raw SQL — parameterized queries only
Two-person rule for production access

Anti-Abuse

30-day watch window on killed pools
Minimum 40% compute burn before kill allowed
Timing correlation detection
Reputation nuke for violations (permanent ban, earnings frozen)