I can’t judge based on this alone, but it depends on the bug severity (low/medium/high/critical). Immunefi and HackerOne are usually pretty responsive, often within 20–30 min for critical. It has its pros and cons. I don’t think the dev team should set aside their mission to deal with spam, as they probably did last month, though they’d certainly want very few people to know about some vulnerabilities.
I don’t think it’s a good idea either to close the door on people digging into the code and finding exploits that could be lethal to the project, without them being advertise and maximize the incentivise to report to zcash instead of exploiting or re-selling them.
I tend to converge with @earthrise, just make the bug bounty for what actually matters high/critical exploit and that need to be patched urgently.
That said, it would have been good to see the team develop some kind of AI-assisted triage system before launching an official bug bounty program.
It’s already possible tbh, and that’s where it’s gonna end up. Automatic triage can just be done as CTF at the end.
I generally agree with the view that we have reached a point where high-quality information is more important than having a large quantity and variety of information.
I better not see any of these companies that shut down their bug bounty programs because of “too much AI slop” telling everyone how seriously they take security after getting exploited.
If you’re responsible for safeguarding millions or even billions of dollars in user funds, offering an open bug bounty program with meaningful incentives should be a given. The security research community is one of the most scalable and cost-effective defenses available to you.
The argument that AI-generated reports take up too much time to review has never made much sense to me. If report volume is becoming a problem, why not invest some effort into building internal tooling to help with triage and filtering?
It’s 2026. AI is part of the landscape now. Companies are going to have to adapt instead of pretending they can opt out of it.
Has anyone already been awarded a bounty? I submitted a report via GitHub Security before the bug bounty program closure rules took effect. The vulnerability has since been fixed, but I have not received any payments.
We have deliberately never answered questions about what this procedure looks like. Because, you know, I personally am against constantly pestering someone with questions, quoting their messages from private correspondence, and all that stuff, you know. Yes, maybe we can’t handle the case under request number 567893 and don’t adhere to corporate ethics standards like JP Morgan, but that’s exactly why I mentioned earlier that Zcash is a decentralized community. But that doesn’t mean we aren’t addressing this issue. Just please keep in mind that there were over 80 claims. The developers have done their part of the massive work, and now the final verification of all the data is underway. It takes time because the issue involves money and it’s important work. So this issue is being addressed, and I hope we’ll finish next week and announce the results.
We had reached a point where the issues being reported were largely duplicates of those already identified. All of this was placing a huge burden on the developers, and we would have simply stalled our main plans for updating the Zcash NU7 protocol. So, to avoid spending a huge amount of time later figuring out who found a particular issue first and who found it second, we decided to shut down the program. Another reason was that it became completely obvious that vulnerabilities were mainly being found by neural networks, which are accessible to absolutely everyone. That’s about it, I guess.
Danika has already reached out regarding the currently approved payout. At this point, the next step is for you to provide the requested payment information, including a shielded address, so that the approved payout can be processed.
To answer your broader question: the upcoming announcement this week will focus specifically on the Zebra reports.
The other reports you mentioned, including reports in repositories such as Zcash, Zaino, Lightwalletd, and Wallet, will not be included in this week’s results or payment decisions.
Any additional reports would need to be handled separately through the appropriate review process, once remediation is complete and public advisories can be properly coordinated.
For reports that are still pending remediation or have not yet been publicly disclosed, we cannot discuss eligibility, severity, payment expectations, timelines, or review status in this thread.
If there are further updates regarding process or payment handling, they will be communicated through the appropriate administrative channel.
For now, please provide the requested payment information to Danika so the currently approved payout can move forward.
what is ZCG’s final decision regarding Zebra’s critical reports that were submitted before the bounty program launched?
since then, there have been some comments and reactions, and the majority, including the core engineers handling the reports, appear to be in favor of applying it retroactively.
Hello @0x15 We did not have your email address and were unable to confirm whether this forum account belongs to the same person as the associated GitHub account. As a result, we sent a direct message to the X account listed on the GitHub profile yesterday.
Please log in to that X account and follow the instructions in our message to verify your identity. Thank you!
7
