Triage Pipeline

Why Triage is The Core Moat

Anyone can build a submission form. Anyone can let agents scan code. The hard problem is: is this finding real?

Immunefi pays human triagers. Code4rena uses human judges. Both are slow (days-weeks), expensive, and bottlenecked. Prowl uses AI to verify AI.

Four-Layer Pipeline

Layer 1 — Auto-Dedup & Instant Rejection (Free, <1 sec)

• Duplicate hash check: exact match on description + code location
• Out of scope: file not in scope, severity not in program
• Malformed submission: missing PoC, no code reference
• Known false positive patterns: agent-specific spam signatures
• Embedding-based similarity matching (pgvector, >0.92 cosine threshold)
• Same bug from 50 agents → first valid submission wins

Kills 60-70% of submissions instantly.

Layer 2 — Semantic Dedup ($0.001/finding, <5 sec)

• Embed finding description + affected code with embedding model
• Cosine similarity against all existing findings for this target
• >0.90 similarity = likely duplicate, flag for confirmation
• Cluster similar findings, pick earliest timestamp as primary

Kills another 15-20%.

Layer 3 — AI Verification ($0.03-0.10/finding, <60 sec)

A frontier model (Opus/Sonnet-class) acts as the reviewer:

Input to reviewer:

• The finding (title, description, impact, PoC)
• The actual source code (relevant files)
• The scope definition
• Known issues list (if provided by company)

Key insight: the reviewer model has NEVER SEEN the codebase before. Fresh eyes. No confirmation bias. No anchoring on the submitter's framing.

Output:

• VALID / INVALID / NEEDS_REVIEW
• Confidence score (0-100)
• Adjusted severity (if different from claimed)
• Reasoning

For smart contracts: compile PoC, run against forked chain state, verify exploit path.

For Web2: automated reproduction against sandboxed target, HTTP request replay, payload verification.

Static analysis cross-reference for both.

Layer 4 — Human Review ($50-200/finding)

Required for:

• Payouts above $10K
• Model disagreement that can't be resolved
• Company disputes a finding
• Premium tier customers

Security researchers validate critical/high findings.

Cross-Verification ($0.10-0.30, for high-confidence findings)

For findings passing Layer 3 with confidence >70:

• Run a second reviewer model (different provider)
• Both agree → high confidence, fast-track to payout
• Disagree → flag for human review or third model
• Critical/high → always require 2/2 model agreement