Same rules they use on researchers. Applied to vendors.
Bug bounty platforms built a system where vendors triage, downgrade, and reject researcher findings using severity classifications and scope rules. We adopted the same framework. Same triage language. Same severity scoring. Same finality. The difference: the target is concealment, not code.
Community Reports
You found a silent patch in an open-source project. A dependency bump that quietly resolved a CVE. A commit message that says “refactor” but changes authentication logic.
Submit the evidence. If validated against the taxonomy and a CVE is filed, you earn a bounty. Anonymous submissions accepted.
Whistleblower Reports
Your organization is suppressing vulnerability disclosure. Hiding patches behind misleading commits. Pressuring researchers into silence via NDA. You have original information derived from your own knowledge, communications, or observations in your employment.
Under Ontario’s Securities Act and Commodities Futures Act, contractual provisions designed to silence you from reporting securities-related misconduct are void. Your NDA does not protect your employer. It protects you. Employers who take reprisals face enforcement action and civil liability, including reinstatement and two times lost pay.
Submit through Whiten Baker and the evidence reaches regulators through our pipeline. Not through you. Anonymous submissions accepted. Protections apply regardless of whether enforcement action results.
Vendor Self-Disclosure
You know you have undisclosed patches. You know our scaffolding is monitoring your ecosystem. You can wait for us to flag it and deliver it to a regulator inbox. Or you can come forward.
Self-disclosed patches are filed as “proactive disclosure” instead of “detected concealment.” The CVE still gets filed. But the narrative changes from “caught” to “cooperated.”
Every way they hide. Every way we find it.
Vendors fix vulnerabilities without telling anyone. They relabel security patches as “refactoring.” They bury critical fixes inside thousand-line feature PRs. They use bot accounts, ghost contributors, and foundation intermediaries to obscure who knew what and when.
We mapped every technique. All of them. Then we built automated detection for each one.
Confidence
7-layer augmented architecture built for continuous silent patch detection. Currently active across 9 of 32 supported ecosystems. Expanding.
Validated
Three layers. Zero gaps.
Automated Detection
Commit-level obfuscation, history manipulation, platform abuse, dependency chain laundering, build-level concealment, and behavioral evasion. The scaffolding classifies every code change in real time. No human in the loop.
Heuristic Detection
Pattern analysis across oversized PRs, conditional compilation tricks, rename-then-fix sequences, and AI-assisted refactoring disguises. Higher noise floor. The scaffolding flags; an analyst confirms.
Context-Dependent
Cross-company fix laundering, foundation intermediaries, audit suppression, NDA silencing, planted contributors, and temporal dispersion. Requires organizational intelligence. Temporal correlation is the signal.
We tried to prove them innocent. Here is what happened.
Every finding we deliver uses Analysis of Competing Hypotheses. The CIA developed it. Intelligence analysts, forensic accountants, and securities regulators use it. We use it because it is the only framework that survives cross-examination.
The method: list every possible explanation for the evidence, including every innocent one. Then systematically test each explanation against the facts. You are not building a case for guilt. You are destroying every path to innocence. What survives is irrefutable because you already killed every alternative.
Case File: Consensus engine vendor and a major bug bounty platform.
A researcher submits a critical finding to a vendor through a major bug bounty platform. What follows is tested against three competing hypotheses.
Good-Faith Process
The vendor operates a legitimate security program. Reports are triaged honestly, findings are remediated, and disclosure follows industry norms.
Process Failures
The vendor intends to operate properly but suffers from miscommunication, understaffing, or honest mistakes in triage and remediation timing.
Coordinated Suppression
The vendor and platform coordinate to close valid reports without credit, suppress disclosure, and silently patch while denying the finding externally.
Good-Faith Process
Process Failures
Coordinated Suppression
Every innocent explanation was tested first and failed.
No single piece of evidence convicts. The conviction comes from the systematic elimination of every alternative. This is how every finding we deliver is structured. Not “we found guilt.” Rather: “we searched for innocence, exhaustively, and it does not exist in the evidence.”
The conspiracy vulnerability.
The most sophisticated hiding techniques share a common dependency: coordinated silence across multiple people.
Cross-company fix laundering requires engineers at two separate organizations to agree, without written record, to disguise a security fix as routine maintenance. Audit laundering requires auditors and executives to agree that findings will never be published. NDA silencing requires legal teams, platform operators, and researchers to all comply indefinitely.
Every one of these is a conspiracy. And conspiracies have a well-documented failure mode.
The practical result.
Vendors who attempt organizational hiding take on more risk than vendors who simply disclose. The hiding does not reduce their exposure. It converts a fixable compliance issue into potential fraud.
One person sinks the ship.
Every person added to the conspiracy is a point of failure. Every legal agreement is a document that proves knowledge of the vulnerability and intent to suppress disclosure.