Redline

Redline lets security researchers report bugs privately and get paid fairly. A researcher files a sealed report: it's encrypted in the browser, and its key is held by an OutLayer TDX enclave, so the server only stores ciphertext. Only the researcher and the teams they invite can read it. The two sides negotiate a bounty in a private chat, and the team locks the reward in a NEAR escrow contract (redline-escrow.testnet). The team then submits its fix PR, and the researcher confirms it, which pins the PR and its author on chain. When the PR merges on GitHub, the enclave checks the merge and the author, and the escrow pays the researcher automatically. If the team runs out the deadline, the report goes public. Paid fixes appear on a public disclosures page and a researcher leaderboard. A read-only JSON API lets AI agents verify every payout themselves (escrow state, merge and transactions) without ever seeing a private report. Five real reports have been fixed and paid on testnet so far.