Can You Sneak Fake Code Past Our Fabrication Detector? ($300 Challenge)

Can You Sneak Fake Code Past Our Fabrication Detector? ($300 Challenge) BUDGET: $300 fixed price, paid on delivery of the report. SKILLS: Security Assessment, Penetration Testing, Application Security, Python, Code Review EXPERIENCE LEVEL: Expert We want an independent person to try to break specific claims about one product and write down what held and what failed. A report that says FAILED is a good result for us, as long as it is accurate. WHO WE ARE FIRME AI CORPORATION (California) builds CAIN-42, a Byzantine trust fabric that governs what AI agents are allowed to do. This job covers one product: FALSEWORK fabrication detector. It backs a paid offer: Fabrication Audit: $1,500 / $3,500 / $6,000 fixed (revenue stream #1). WHAT IT DOES FALSEWORK reads Python and grades each piece REAL, PARTIAL, STUB or UNKNOWN, with the line that gave it away: verifiers that can't fail, error handlers that grant access, random numbers dressed up as computation, health checks that never touch the thing they vouch for, mocks in production code. Deterministic AST and regex rules, no AI model in the decision. CLAIMS TO TEST C1. The same file always gets the same findings and grade (ignore the scanned_ms timing field). C2. Known fabrication patterns are caught: return-True verifiers, fail-open except blocks, random 'confidence', constant 'scan' results, MagicMock in production paths. C3. Honest code stays REAL: for example an HMAC check using compare_digest passes clean. WHAT WE WANT YOU TO DO (black-box, about 2-4 hours, no NDA needed) - Write at least 15 fabricated functions that a reviewer should catch, and at least 15 honest look-alikes. Send each to the scan endpoint. - Measure the false-negative rate (fakes graded REAL) and the false-positive rate (honest code flagged). - Try evasion: renames, splitting logic across helpers, getattr tricks, comments, equivalent rewrites. - Re-send identical files and confirm the findings repeat. IT FAILS IF A plainly fabricated verifier or fail-open auth check graded REAL, or identical input giving different findings. WHAT WE ALREADY KNOW (please spend your time on what we don't) It is heuristic: AST and regex rules, Python only. It has false positives and misses patterns it WHAT WE NEED BACK 1. A short report (PDF or Markdown, 1-3 pages is fine): what you ran (every input, or a file of them), a HELD / PARTIALLY HELD / FAILED / NOT TESTED verdict per claim with evidence, and findings with reproduction steps. 2. Your name and credentials on the report, and a dated statement that you have no financial interest in FIRME AI CORPORATION beyond this fee. 3. Permission to publish the report, in full or as a summary you approve. We publish failures as openly as passes, and we will not call your report a certification. RULES OF ENGAGEMENT - No load tests, fuzzing at volume, scanners or denial-of-service against cainstudio.online, mcpgate.online or clawx.click. They are shared production hosts. Keep to a few hundred requests; ask us if you need more. - Report anything serious (a forged signature that verifies, a bypass of a core claim) privately as soon as you find it. - Before trusting a signing key, confirm its fingerprint with us by message. That check is part of the test. THIS JOB IS NOT - A certification (SOC 2, ISO 27001, ISO 42001, EU AI Act). None of those apply here. - A request to make us look good. no rule for. Treat output as triage, not proof.