Trust centre · Closed programme

Forgery bounty

The Seal forgery bounty ran from 27 August 2026 to 12 September 2026 and is closed to payment. Nothing in it is retracted. Every Seal surface still says change one field and the check fails, the formats and both verifiers are public, and a report that shows otherwise is still the thing we most want to receive. What has changed is that no payment is offered: we are a small team and cannot service a paid programme responsibly right now. If it reopens, it will be announced here first.

Everything you need is public. The formats and both reference verifiers are at github.com/Aqta-ai/attestation-spec, the key at api.aqta.ai/v1/attestation/public-key, the public log head at app.aqta.ai/transparency. A production receipt to start from is on aqta.ai/verify.

What we want to hear about

A forged receipt
An ATTESTATION-v1 or ACTION-v1 record that verifies under the published key and was never issued by the Seal gateway.
A silent alteration
A change to any signed field of a genuine receipt that both reference verifiers still accept.
A false inclusion proof
An inclusion proof that verifies against a published head for a leaf that is not in the public log.
A hidden removal
A consistency proof between two published heads that verifies while a leaf present under the first is absent under the second.
A verifier divergence
Bytes on which the TypeScript and Python reference verifiers return different verdicts. A defect in a reference implementation rather than a forgery, and the class our own sweeps and outside reports find most often.

Checking an inclusion or consistency proof needs a verifier you can run yourself. That shipped on 27 August 2026: aqta-verify-proof, in aqta-verify-receipt on npm and PyPI, written twice in two languages against RFC 6962 and checked against the published conformance vectors on every change. All five classes above can now be exercised by someone who has never spoken to us.

That class is on the list because our own adversarial sweeps keep finding them: a canonical-number divergence, seven more in an earlier release, in August an encoding defect that let one signature be spelled three ways, and days later the same lenient decoding in our own browser checks. Each was fixed and published, the verifier defects as conformance vectors, and all of it is now checked on every push. In September 2026 two outside reports arrived within a week, an ordering comparator and a replacing UTF-8 decoder, fixed in 1.2.5 and 1.2.6.

The current build has been through 658 mutated receipts across two seeds and both record formats, covering structure, duplicate member names, the canonical-number band, unicode, signature spelling and document bytes, with no divergence between the two verifiers. That is what has been tested. It is not a claim that nothing is left.

What does not

Attacks on Aqta infrastructure, accounts or people: phishing, credential theft, denial of service, social engineering. Report those to security@aqta.ai under the disclosure policy.
Receipts signed with the demo key. Sample receipts on aqta.ai/verify and app.aqta.ai are labelled and signed with a key that is published precisely so you can tamper with them.
Anything that requires the issuer private key. If you have it, that is an incident, not a forgery; tell us immediately.

How to report

Send the bytes
Email security@aqta.ai with the record or proof, the exact verifier command that accepts it, and the version of the verifier you ran. We are a small team; we reply as soon as we can rather than by a promised clock.
We reproduce, fix and publish
A report is confirmed when we reproduce it with the published verifiers. A confirmed report is fixed, published as a conformance vector, and credited in the changelog with your name if you want it there. No class is paid.
Terms history, kept so nobody has to ask
Opened 27 August 2026: €5,000 to the first valid claim in each forgery class, verifier divergence at a quarter. 12 September 2026: the divergence class moved to credit only. 12 September 2026: closed to payment for every class. One verifier-divergence report was received before closure, on 9 September 2026; it is confirmed, fixed, credited, and not paid. We say that here rather than let it be discovered.
The limits we already publish
A signature does not prove the computation ran, that every decision was recorded, or that the decision was right. Those are documented in the threat model and are not what this programme was about. Showing the check itself can be fooled is.

Published by Aqta Technologies Limited, Dublin. Good-faith research under these rules will not be met with legal action. Checked rather than believed.