gleam Results

Gleam security reviews

Gleam's source code is public. Anyone can run an independent security review of it with a coding agent.

How to help

  1. Review a release Run a review and sign the result with your Gleam wallet. Earns GLEAM
  2. Found something? Report it Report it privately to the maintainers. Earns a share of the bounty pool

1. Review a release

The first 100 signed reviews of each release are awarded GLEAM.

Paste this into your agent

Requirements

You'll need a Gleam wallet enrolled in Gleam Points and a coding agent that can run commands on your computer. Browser chats can't run it.

Review Sign Earn

  1. Your agent clones Gleam's public code at the release tag and runs its tests.

  2. It runs Google's OSV-Scanner to check for publicly reported vulnerabilities in Gleam's dependencies.

  3. It reviews Gleam's security-relevant code and answers challenges about specific functions, to show it read the code.

  4. You open a link in your Gleam wallet and sign the review's attestation, which records the release, model and result.

Review rewards

Review rules
  • Each release has 100 paid reviews.
  • Reviews 1 to 20 earn 0.1% of the GLEAM points minted the previous day. Reviews 21 to 100 earn 0.02%.
  • Each wallet can submit one review per release.
  • After 100, reviews are still recorded and published, but they earn nothing unless they find a vulnerability.
  • Paid places reset with each new release.

2. Report a vulnerability

If your review finds a vulnerability, your agent will guide you in reporting it and you earn a share of Gleam's bounty pool. The bounty pool grows daily.

How to report

Report privately through GitHub's private vulnerability reporting. If your agent found the problem during a review, it files the report for you and includes the attestation id.

Report privately on GitHub

Maintainers aim to acknowledge reports within a few days. See the security policy for scope and what to include.

Bounty rules
  • The pool grows each day by 2% of the GLEAM points minted the previous day.
  • A confirmed vulnerability is awarded a share of the pool at the time it's confirmed:
    SeverityShare of pool
    Critical50%
    High25%
    Medium10%
    Low2%
  • A maintainer sets the severity using the criteria in our security policy.
  • Only the first report of each vulnerability is awarded a share.
  • Small issues may go through a public pull request. Anything that could put keys or funds at risk must go through a private advisory.
  • Unclaimed balance stays in the pool.

Questions

Is it safe to run?

Your agent clones Gleam's public code and runs its tests and a security scanner. It never needs your seed phrase, private key or real funds.

You can read the full review instructions before running anything.

Can I verify the reviews myself?

Yes. Every attestation is signed by the reviewer's wallet and published with its signature on the results page. You can check each one without trusting Gleam.

What is GLEAM?

GLEAM is the reward token used by Gleam Points and the security bounty programme.