Anyone can write "senior, 300 valid reports, $500k earned" on a profile. The question that matters is not what someone claims — it is whether you can check it, and whether the claim would cost them anything if it were false.
Two kinds of reputation
There is a real difference between:
- Declared reputation — numbers a person types about themselves. Useful as a hint, worthless as proof. Easy to inflate, impossible to disprove.
- Earned reputation — a record that only exists because other people interacted with them and reported the outcome. Hard to fake, because faking it needs other real accounts to play along.
A trustworthy system leans on the second and treats the first as decoration.
What "checkable" really means
Declared stats become trustworthy the moment they sit next to a linked, public profile you can open in one click. The claim "300 reports" is meaningless alone; "300 reports — see HackerOne profile →" lets the doubter verify in seconds. The link does the work the number cannot.
Why peer outcomes beat platform stats
Public HackerOne or Bugcrowd stats tell you someone can hack. They tell you nothing about whether they are someone you want to work with — whether they split fairly, delivered their half, or vanished mid-engagement.
That second layer only comes from peers:
- Did past collaborators get paid what was agreed?
- Did they follow through, or disappear once the bug was confirmed?
- Would the people who worked with them do it again?
This is the data that does not exist anywhere else, because it is created by the collaboration itself.
How to guard it against gaming
Any reputation system worth trusting has to assume people will try to game it:
- No unilateral reviews. You can only rate someone you actually collaborated with, through an accepted engagement — not a stranger you decided to praise or trash.
- Watch the rings. Two accounts reviewing each other over and over should not be able to inflate their scores; each distinct counterparty should count once.
- Reviews that stick. Feedback that can be quietly deleted the moment it turns negative is not reputation, it is marketing.
Bounterland is built on exactly this: declared stats stay visible but labelled, next to the verified link — and the score that counts comes from real, completed collaborations, weighted so a two-account ring cannot pump it. Reputation you can check beats reputation you have to believe.