A defensive program
Other benchmarks rotted into a leaderboard for the exploit, not the capability. We invite the attack early, credit researchers, and wire every accepted finding back into the bench.
Switch to Nerds mode to read the scope, the rubric, and the fix log.
Defensive disclosure program · v0.1
Every static benchmark eventually rots into a leaderboard for the exploit. We invite the attack and wire every accepted finding back into the bench as a new Reality Engine layer or a task refinement. The catalogue below is the public ledger of that work.
Four tiers. We grade on reach and magnitude, not on offensive sophistication.
Lifts ≥10 percent of cells to ceiling, or breaks trace integrity.
Example. A prompt that silently bypasses the refusal gate for an entire task family.
Single cell trivially passes, or a single TUI gains a measurable metric advantage.
Example. A whitespace canonicalisation gap that flips a strict-equality grader.
Measurable bias visible across the bench at small magnitude.
Example. A locale-dependent tokenizer drift that nudges scores by a fraction.
Effect within published run-to-run variance, or a UX or rendering annoyance.
Example. A leaderboard tooltip that truncates a long model name.
Full rubric with worked examples lives in docs/exploit-rubric.md. Final tier is set by the triage committee.
Four steps. The full protocol lives on /security/submit.
Use the disclosure template. The issue is the authoritative record for every finding we triage.
PGP, signed commit, or ssh-keygen -Y sign. Signing protects both sides against impersonation and replay.
We do not host reproducer code. Link to a reproducer in your repo and describe the attack class in prose.
Accept, reject, or need-info. Accepted findings land as a Reality Engine layer or task refinement.
Program rules in docs/exploit-bounty.md. Rubric in docs/exploit-rubric.md. Ready to report? Start at the submission protocol.
