timevolt
Opening soon. Receipts and payments aren't open yet.
Timevolt / Security report submitted
Software

Preserve an existing authorized vulnerability report and supporting files.

Preserve an existing authorized vulnerability report and supporting files. Keep your original source records together, then date the exact files. It does not prove identity, origin, truth, physical state, presence, consent, authority, sending, delivery, acceptance or outcome.

Try a file locally

Your photos and files stay on your device, so keep them.

EXAMPLE
Security report submitted
1 Nov 2026
Authority time: 14:02 UTC · example
Bitcoin block time: 14:10 UTC · example
Last checked: 15:02 UTC · example
✓ Dated◆ Permanent
Now keep it safe: three things
  1. Keep your photos and files unedited. The receipt only matches the originals. Put them in an album such as “My records”.
  2. Save this receipt to your camera roll.

    Keep the receipt file too. The image is a handy copy; checking needs the file.

  3. Email it to yourself.Email it to myself

    Your mail app opens a draft. Attach your receipt image and receipt file. Don’t attach your photos or documents. Timevolt does not send it or know whether it was sent.

Your record, one step at a time.

Your photos and files stay on your device, so keep them.

Local preview: files are fingerprinted here. Notes and progress stay in this browser. Keep downloaded copies; browser storage is not a backup.

0 items
How?

Add the exact original files for this part of the record. Keep them unchanged; a different export or edit has a different fingerprint.

Add link and screenshots

The link is recorded, not fetched or verified.

    0 items
    How?

    Add the exact original files for this part of the record. Keep them unchanged; a different export or edit has a different fingerprint.

    Add link and screenshots

    The link is recorded, not fetched or verified.

      0 items
      How?

      Record the date, time, place and who you spoke to. New notes are saved separately rather than editing an old note.

      How to keep notes that hold up
      Write it down

      By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

        By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

        How to keep notes that hold up

        Write notes as soon as you can. Keep the original account rather than replacing it later; the venue decides what weight it gets.

        1. Write it down straight away, on paper or in the box on a step.
        2. Put the date, time and place at the top, and who you spoke to.
        3. Use their words where you can; separate what you saw from what you were told.
        4. Sign or initial a paper note, photograph it and add the photo.
        5. Never edit an old note. Add a new dated entry when something changes. A device save time is not independent time evidence or proof of event order.
        Security report submitted
        Security report submitted

        01 · Keep the exact files

        Keep the original files for security report submitted. Include any existing photos, signed records and source-system exports.

        Records to keep: Report · Proof of concept

        Security report submitted

        02 · Date the file’s code

        Your device fingerprints the selected file or manifest. Dated follows an independent timestamp; Permanent follows Bitcoin anchoring.

        An independent time, tied to the exact bytes.

        Security report submitted

        03 · Keep the evidence

        Keep the original files and complete receipt separately, alongside any existing venue, signature and workflow records.

        Keep the originals too. A changed or compressed copy has a different fingerprint.

        Try a file. It stays here.

        Make a test receipt on this device.

        By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

        or drop a file here

        Real cases: why the saved copy matters.

        Real cases where dated records mattered. We don’t claim a time receipt would have changed the result.

        Public vendor dispute · 2013

        Send clear steps with the first report

        A researcher’s first bug report left out a video that showed how the flaw worked. Facebook said its team should have asked for more detail. It fixed the flaw but refused a reward because a later demonstration broke the program rules.

        News account of a vendor dispute, not a court ruling. Reporting quality and a later rule breach were separate issues.

        Summarized on Oct 29, 2026

        Read the source ›

        Related cases

        United States, Ninth Circuit · 2025

        A later bounty deal cannot rewrite earlier access

        Related: Later bounty deal and incident concealment

        A later bounty deal tried to recast an earlier break-in and cover-up. The appeal court kept guilty findings for blocking a watchdog and hiding a serious crime. It left open cases where a bounty program gave permission before access.

        Summarized on Oct 29, 2026

        Read the source ›
        US federal · 2021

        Access rights differ from limits on use

        Related: Database access for an improper purpose

        A person searched a database they could access but did so for a wrong purpose. The top court said that alone did not break the charged computer-access rule. It sent the case back.

        Summarized on Oct 29, 2026

        Read the source ›
        Public vendor dispute · 2013

        Keep the report and the replies

        Related: Unresolved news dispute about report priority; no dated first report was verified as deciding the outcome.

        A researcher said PayPal refused a bug reward because of age. PayPal said the bug had been reported first by someone else, but did not identify that report. The news report left the dispute about the first report open.

        News report, not a court ruling. The vendor’s earlier-report claim was not independently proved.

        Summarized on Oct 29, 2026

        Read the source ›

        What courts, schemes and regulators say.

        Positions below refer to the cited rule or record type, not endorsement of Timevolt. This service is not represented as an eIDAS qualified timestamp provider. A non-qualified timestamp does not receive the qualified timestamp presumption.

        Needs something else · HackerOne platform, program conditions apply

        HackerOne

        Submitting Reports, 14 September 2026

        Submission occurs through a program's report form with details, evidence and required fields. A dated local report does not submit it or establish priority/reward. Current instructions distinguish programs requiring severity from those opted out, effective September 21, 2026; no exploit steps reproduced.

        Source summary as of 2026-10-29. Check the current source and applicable local rules.

        Read the source
        Needs something else · Palo Alto Networks program only

        Palo Alto Networks PSIRT

        Published bug-bounty reporting and eligibility policy

        Report through specified form/email; scope, authorization, actionable detail and earliest actionable submitted report matter. Rewards discretionary; no timestamp-only priority promise.

        Source summary as of 2026-10-29. Check the current source and applicable local rules.

        Read the source

        Other ways to do this

        Prices change. Check each provider’s site for current prices and service details.

        • HackerOne

          Provides Program-managed report submission, triage and disclosure.

          Visit site

        • Bugcrowd

          Provides bounty and vulnerability-disclosure intake, prioritization and remediation.

          Visit site

        • Intigriti

          Provides managed bug-bounty programs and expert report triage.

          Visit site

        Related workflows.

        Model or dataset releaseApp ideaRelease or commit stampTerms in force on a dateQuarterly user access review: the reviewer list, decisions and removals frozen as submittedAccess or license request, manager approval and grant

        Proves / Doesn’t prove

        Proves

        A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents.

        Doesn’t prove

        It does not prove identity, origin, truth, physical state, presence, consent, authority, sending, delivery, acceptance or outcome.

        It does not prove identity, origin, truth, physical state, presence, consent, authority, sending, delivery, acceptance or outcome.

        These are the bounds of a completed proof. The local tester does not establish any time. The chosen court, scheme or regulator decides what to accept.

        Questions, answered plainly.

        Your file stays on your device. During normal receipt creation, your device sends a randomized code made from its fingerprint, plus encrypted recovery data. It doesn't send the plain fingerprint or the random value that opens the code. Keep the original file and the complete receipt for checking. Privacy Policy.

        Does dating my report submit it?

        No. HackerOne describes submission through the program report form and review step.

        Source summary as of October 30, 2026. Check the current source and its scope.

        Context for this answer
        What existing evidence can accompany a report?

        HackerOne permits attached screenshots or demonstration files; preserve authorized existing evidence and respect program confidentiality.

        Source summary as of October 30, 2026. Check the current source and its scope.

        Context for this answer
        Does a receipt guarantee a bounty?

        No. Palo Alto Networks lists eligibility conditions and reserves award discretion.

        Source summary as of October 30, 2026. Check the current source and its scope.

        Context for this answer
        Does earlier local possession settle duplicate priority?

        No. This program identifies the earliest actionable filed report, which is different from a local timestamp.

        Source summary as of October 30, 2026. Check the current source and its scope.

        Context for this answer
        Does a later record provide permission to access?

        No. The amended appeal assessed permission at access and reserved qualifying prior-program authorization.

        Source summary as of October 30, 2026. Check the current source and its scope.

        Context for this answer

        The file tester runs on your device. It does not issue a timestamp or take a payment.

        Keep the records you already have.

        Keep your original files and any existing official records while the receipt service is being prepared.