@AnthropicAI @ClaudeAI Hackathon At
@Cloudflare HQ in San Francisco.
Proof before payout. Bountyloop verifies a security bug report before any bounty is authorized.
Three reports arrived. A DMARC beg-bounty: out of scope, $0. A scanner's resubmission: same root cause, $0.
The real one (any tenant can read another company's invoice) replayed 3 of 3 times in an isolated Cloudflare Sandbox, against a copy of the app, never production.
Claude (
@AnthropicAI) wrote a narrow block. A Cloudflare Worker enforced it: every replay got a 403, 0 of 3 returned invoice data.
Four checks passed, so $250 was authorized with a signed receipt. The payout is simulated until Stripe Connect (
@stripe) is on; no money has moved.
A local gate scores each case in the demo. I also built the pipeline as a six-agent orchestration on
@BrainbaseHQ: typed handoffs, one real run, a nightly regression schedule. Don't triage claims. Verify exploits.