Correction, bypass, and replication programs
HOL Guard accepts evidence that makes the product look better, worse, or unchanged. Program eligibility is based on validity, reproducibility, scope, and safety, never on a favorable conclusion.
Important: public program status does not promise a specific payment amount. Any cash or non-cash award requires validation and written terms. Testing authorization is limited to the published scope and never extends to third-party systems, data, or credentials.
To submit a correction, safe bypass report, or replication proposal, email [email protected]. Security findings should follow the HOL Guard security policy and remain private until coordinated disclosure permits publication.
HOL Guard Correction Bounty
correction_bounty
Reward reproducible corrections to public HOL Guard security, product, benchmark, or methodology claims.
Eligible work
- Specific factual error with public contradictory evidence
- Reproducible metric/methodology error
- Material omitted limitation that changes interpretation
Out of scope
- Style-only edits
- Duplicate already-known correction
- Threats, harassment, spam, or fabricated evidence
- Reward terms
- Any cash or non-cash award must be confirmed in writing after validation and before acceptance of payment terms. No amount is promised by this public rule page.
- Result neutrality
- Corrections are rewarded for validity and materiality, not for making HOL look better or worse.
- Conflict disclosure
- HOL operates and commercializes HOL Guard. Reviewers must disclose any material relationship that could affect the correction review.
HOL Guard Safe Bypass Bounty
safe_bypass_bounty
Invite safe, reproducible reports of Guard control bypasses under explicit authorization and non-destructive testing rules.
Eligible work
- Bypass demonstrated on researcher-owned systems or published test fixtures
- Policy or enforcement gap with minimal reproducible proof
- Safe prompt/tool/package/MCP control bypass that does not expose third-party data
Out of scope
- Testing against systems or data without authorization
- Credential theft or secret exfiltration
- Persistence, destructive payloads, denial of service, social engineering, or public zero-day disclosure before coordination
- Reward terms
- Eligibility and any award are determined after validation under the published scope. Researchers must not assume a payment amount or authorization outside this scope.
- Result neutrality
- A valid bypass remains valid even if it is unfavorable to HOL Guard; payout decisions cannot depend on suppressing publication after coordinated remediation.
- Conflict disclosure
- HOL is the product operator and potential payer. Any award, employment, sponsorship, or commercial relationship must be disclosed with a public research result.
HOL Guard Replication Microgrant
replication_microgrant
Support independent replication of a frozen HOL Guard benchmark, recommendation-observatory, or threat-research method.
Eligible work
- Independent reproduction using frozen methods
- Negative, null, contradictory, or favorable replication
- Method critique accompanied by reproducible evidence
Out of scope
- HOL-authored self-replication presented as independent
- Result-contingent compensation
- Cherry-picked or undisclosed exclusion of valid unfavorable runs
- Reward terms
- Each grant requires a separate written award defining scope, amount, deliverables, disclosure, and publication rights before funded work begins.
- Result neutrality
- Funding amount and eligibility cannot depend on a favorable HOL result; valid unfavorable and null results remain publishable.
- Conflict disclosure
- Any grant or support from HOL must be disclosed prominently in the replication artifact and public report.
Rules that apply to every program
- No automated posting, fake reviews, hidden sponsorship, or favorable-result payments.
- No public zero-day disclosure before reasonable coordinated remediation when a real vulnerability affects third parties.
- No customer data, private prompts, secrets, or private telemetry may be collected to prove a finding.
- Valid unfavorable, null, contradictory, and correction results remain eligible for publication.
- Any HOL funding, sponsorship, employment, or other material relationship must be disclosed with public results.