GitScout · Part 1 — Trust Is the Product

GitScout aggregates real open-source bounties and issues and filters out the farms and scams that pollute the space. This first paper documents why the product exists, the research that shaped it, and the single design decision that defines it: trust is the product, not a feature.

01The problem

"Bounty aggregator" sounds like a solved problem — GitHub search plus a label:bounty filter. In practice that naive feed is close to worthless:

The label space is polluted. A large fraction of label:bounty repositories are engagement farms: they pay vanity tokens ("star this repo," "join our Discord," "post on X") that have no cash value. In our raw scrapes, roughly 40% of the label space was one token-farm cluster.
Real cash hides behind different markers. Genuine paying bounties are signposted not by the raw bounty label but by platform fingerprints in the issue body — algora.io in:body, Funding on Polar in:body, or a platform-specific 💎 Bounty label. A tool that filters on the obvious label misses the real money and surfaces the noise.
Outright scams exist. The catalyst for GitScout was a live scam mirror (bounty-plaza) that re-hosts legitimate-looking bounties to lure developers into depositing crypto (USDT) to a "treasury" address they never recover. Any aggregator that ingests uncritically becomes a distribution channel for the scam.

The real problem isn't aggregation.It's discrimination — telling real from fake, payable from performative, winnable from picked-over — at scale, cheaply, and honestly.

02Market research

We studied the live landscape rather than trusting platform marketing.

Platform	Payout	Fee	Notes
Algora	Fiat USD via Stripe Connect (2–5 days post-reward)	~19% + Stripe	Largest. `/attempt #N` with a plan, then a PR with `/claim #N`; UI changes need a demo video.
Opire (opire.dev)	Fiat	~4%	Smaller, less crowded. Returned HTTP 502 during checks — a lesson in not single-sourcing discovery.
Polar.sh	Fiat	—	Issue funding, marked by `Funding on Polar`.
Gitcoin / Immunefi	Crypto	—	Legitimate but a distinct, wallet-required path. Out of scope for the default user.

Algora explicitly warns that "low-quality AI PRs will not receive review and will be closed." The scam layer — bounty-plaza and its class — re-skins real bounties and inserts a crypto-deposit step. The tell is structural: numeric/throwaway owner accounts, a treasury address, and social-task "bounties" paying non-currency tokens.

03The core insight

Across all three layers, the differentiator a raw feed cannot provide is judgment about trust and viability. We crystallized this into the product thesis:

The thesisGitScout's moat is that it tells the truth about a bounty — including when the truth is "don't bother."

This reframes every downstream decision. The aggregator is not optimized for volume of listings (that favors the farms); it is optimized for precision — a small feed you can trust over a large feed you cannot.

04Hypotheses, stated to be falsifiable

Good research states what would prove it wrong. We committed to four testable claims:

The label space is farm-dominated — a large minority of label:bounty hits are engagement/token farms.

Structural signals separate scam from real cheaply, with no network call (owner shape, title junk, social-task language, reward-unit type, star count).

Real cash lives behind platform markers, not the raw label.

A newcomer can win a first bounty quickly by picking a small task off a popular board. The naive thesis — and, spoiler, the one the data falsified.

05Research method

Local-first trust filtering. Every candidate is scored by a pure function (prefilter_farm) before any network reputation call — fast, free, deterministic, and unit-testable.
Live, trust-filtered scrapes of the real paying markers, stack-filtered to Python and TypeScript, merging results from multiple GitHub-valid query passes rather than one combined query (which the GitHub Search API can silently reject).
Manual live verification of individual candidates in the Algora and GitHub UIs — the only way to read the amount, the reward state, and, decisively, the competition.

06What we found (preview)

Hypothesis	Verdict	Evidence
H1 — farm-dominated label space	Confirmed	~40% of the sampled label space was a single token-farm cluster.
H2 — structural signals separate scam from real	Confirmed	Live re-probe dropped a farm's admitted count from 20 to 0 after the engagement gate landed.
H3 — real cash lives behind platform markers	Confirmed	Platform-marker filtering surfaced 18 trusted candidates from 41 raw hits; the raw label space was mostly noise.
H4 — newcomer wins a first bounty fast	Falsified	Public boards on hot orgs are saturated red oceans (Part 3).

The falsification of H4 is the most valuable result.It created GitScout's second product axis — a viability signal layered on top of the trust signal. Parts 2 and 3 build on that.

Part 2 → covers architecture, the data model, security testing, and validation. Part 3 covers the end-to-end lifecycle of claiming and fixing a real bounty — including the honest account of why we did not fabricate a win.