ProofGate

The problem AI has made writing vulnerability reports almost free. Report volume to platforms like HackerOne has more than doubled, and much of it is plausible but wrong: functions that don't exist, protections that are actually there, or impact that was never tested. curl ended its bug bounty in January 2026 after valid reports fell below 5%. Each convincing fake still costs a maintainer or security analyst up to an hour to disprove, so real bugs wait in the queue behind them. What ProofGate does ProofGate is an AI gatekeeper that checks a security report against the real code before a human spends time on it. It splits the report into atomic claims, and a Muse Spark agent verifies each one in the source at the stated version, citing the exact file and line it read. For impact claims, it writes and runs its own reproduction test in a sandbox. A Muse Wonder judge then returns a verdict (fabricated, claim false, confirmed, or inconclusive) with an evidence level from 0 to 5. The result: in a few minutes and about $1, a triager sees which claims hold up and why. On 12 labeled reports, ProofGate got 11 right, and it never confirmed a fake or dismissed a real bug. It's propose-only, and a human makes the final call. If the form gives one combined field, paste both parts together. They read naturally as one piece.