By Isaac • October 24, 2026 11:13 pm •
Firedancer has put a literal price on getting a security report into its bug-bounty pipeline.
Under terms that took effect October 18, a researcher must burn 1 SOL before a report can qualify for a payout. That burn is permanent and is not refunded when the report turns out to be invalid, outside the program’s scope, or a duplicate of a vulnerability someone else found first.
Trending: IOM Data: Trump admin. border policies have saved hundreds of migrant lives
The terms also require an end-to-end proof of concept against an allowed branch and configuration, with practical impact and a clear attacker model. After the burn is confirmed, the team says a researcher should receive initial contact through a GitHub Security Advisory within 96 hours; decisions and fixes can take
Continue reading
Join the conversation!
Please share your thoughts about this article below. We value your opinions, and would love to see you add to the discussion!