A small update: an average of 7 - 8 days has now passed since I privately submitted 44 proven and fully documented security findings across 5 projects:
2 Critical
14 High
15 Medium
13 Low / Informational
I also submitted 5 additional assurance observations.
Four of those projects have not responded at all.
The fifth appears to be fixing at least some of the issues, but its entire response to hoirs and days of work was a single sentence telling me that I would receive nothing.
I spent 2 weeks investigating their systems.
I found these weaknesses before someone malicious did. In return, I received silence, dismissal or quiet remediation without even basic respect for the person who did the work.
Those 2 weeks are gone. I cannot get that time back, and the message from these projects could hardly be clearer: they expect people to protect their businesses and users for free, then cannot even be bothered to send a proper response.
There is one thing I want to acknowledge:
During the last 10 days, 2 private individuals sent a combined 1.5 SOL to my donation wallet. It was the first direct support I had received in weeks.
To both of them, thank you.
Every dollar helps protect the independence that allows me to investigate projects without sponsors, paid promotions or anyone expecting favourable coverage in return.
My reach on X has currently been cut to roughly 1/10 of what it was, so I will stop tweeting and take a break.
When I return, I may publish parts of the evidence and name the projects that chose silence over accountability.
We will see.