plutoOpen app

Verifiable vulnerability disclosure

Time to fix.
A record to trust.

Bring researchers and protocol teams together through encrypted reports, clear release windows and independent verification.

Get started See how it works

Start locally. No account or wallet needed to encrypt a report.

From private report to public proofDisclosure flow
  1. Encrypted report

    Prepare locally. Keep your recovery keys.

    Private
  2. Committed release window

    Post and bind an immutable record.

  3. Verified private notice

    Give the protocol team time to respond.

  4. Public disclosure

    Check the commitment and released report.

    Public

Protocol funding does not give the payer control of the report or its posted deadline.

How it works

A clear path from finding to disclosure.

  1. 01

    Prepare in private

    Encrypt your report locally and save your recovery file. Your report has its own author identity, independent of your wallet.

  2. 02

    Commit to a window

    Choose the release window, review costs and confirm the deadline. Once posted and bound, the record cannot be changed.

  3. 03

    Notify, then verify

    Share a signed notice with a verified protocol contact. After disclosure, anyone can check the public record and decrypt the report.

One protocol. Independent roles.

Choose where you come in.

01 / Researchers

Keep authorship. Set the terms.

Prepare a report, choose its release window and keep a recovery copy. Disclose independently through self-funding, or request protocol funding.

Prepare a report

02 / Protocol teams

Build a trusted intake channel.

Verify your protocol identity, publish a contact key and manage private notices and funding requests. Paying for intake never buys control of a posted deadline.

Open protocol intake

03 / Public verifiers

Check the record yourself.

Inspect the registry and disclosure events, verify the report commitment and decrypt the released ciphertext without a protocol account.

Verify a report

Independent by design

Funding supports the process.
It does not control the outcome.

  • Pluto never receives your plaintext report or encryption key.
  • A posted deadline cannot be cancelled, extended or amended.
  • Public verification checks chain evidence, not a platform promise.

Before you begin

A few things to know.

Do I need a wallet or account?

You can encrypt a report and save private recovery without either. Protocol staff connect a wallet and sign in to manage intake. Each report uses an independent author key.

Can a protocol stop a posted disclosure?

No. Once the trigger is posted and bound, protocol funding, account changes and billing cannot cancel, extend or amend it. Review the release window carefully before submitting.

What are the trust assumptions?

Pluto does not hold your report key. A threshold committee holds the sealed key and participates in its release. Committee operators must be trusted not to release it early; Pluto does not guarantee privacy against those operators or protection from front-running.

What does it cost?

Costs depend on live protocol fees, escrow and transaction gas. The workspace itemizes costs and identifies the payer before you confirm. A funding request needs protocol approval.

How do I submit a report?

Prepare your report, save private recovery and review the live costs in the workspace. Confirm the immutable deadline before submitting on Sepolia. Self-funded reports use the report author address; protocol funding requires approval. Pluto does not judge severity or guarantee a bounty.

Your next step

Start with your report.

Explore every step before committing to a release window.

Get started