MetaHackers

Candor: say what happened, not who you are. Candor is a zero-knowledge whistleblowing platform where Muse Spark Open, Meta's open-weights model, turns scattered, redacted evidence into a cited, verified timeline reviewers can trust, without anyone learning who reported it. The problem: insiders are how wrongdoing gets found (43% of occupational frauds are detected by a tip, ACFE 2024), but reporting exposes the person who does it: hotlines ask who you are, files carry author names and GPS tags, and one curious insider can open everything. Organisations that receive reports get a pile of emails and screenshots and no way to tell what is documented from what is merely alleged. The EU Whistleblower Directive requires every employer with 50+ staff to run a confidential channel and give the reporter feedback within three months. What it does: 1. Prove you may report without saying who you are: a Self passport proof plus RFC 9474 blind RSA tokens make the report unlinkable to verification; a campaign-scoped nullifier caps abuse. 2. Clean evidence on the device: PDF, Word, email and image metadata is stripped and re-checked; names become consistent placeholders; the reporter approves every redaction. 3. Seal it so no single party can read it: XChaCha20-Poly1305, key split 2-of-3 with Shamir, one share per reviewer. The server only stores ciphertext. 4. Analyse with Meta Muse, grounded in sources: a twelve-stage pipeline extracts claims three times, matches every quote character by character against its passage, verifies each claim against only its cited text, solves the timeline as a temporal network, finds contradictions, calibrates confidence with a fixed formula and writes a brief where every point cites claims. Planted prompt injections are quarantined. 5. Pay per analysis unlinkably over x402. 6. Audit every access: opening originals needs a reviewer quorum, and every action goes into an RFC 9162 Merkle transparency log anyone can verify in the browser. 7. Talk back anonymously: an eight-word codename lets reviewers ask the reporter follow-up questions. Does it work: six synthetic cases evaluated on Muse Spark Open (114 model calls, $1.88, all committed and replayable): 0 identifier leaks, 100% of quotes verbatim in their source, 100% of planted events recovered, event order Kendall tau 1.00, 100% schema-valid under 30% chaos corruption, prompt-injection attack success 0%. Weak spots (contradiction recall 17%) are shown openly on the /evals page. Live demo: https://wenshen18643.github.io/candor/