{"id":198,"date":"2026-08-01T13:56:30","date_gmt":"2026-08-01T08:26:30","guid":{"rendered":"https:\/\/tierones.io\/blog\/?p=198"},"modified":"2026-08-01T13:56:31","modified_gmt":"2026-08-01T08:26:31","slug":"verify-candidate-proof-of-work","status":"publish","type":"post","link":"https:\/\/tierones.io\/blog\/verify-candidate-proof-of-work\/","title":{"rendered":"curl&#8217;s Valid Bug-Report Rate Fell From 15% to Under 5%. Self-Reported Proof Has Stopped Carrying Signal."},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">For years, more than 15% of the security reports sent to curl turned out to be confirmed vulnerabilities. Then, as Daniel Stenberg records, <a href=\"https:\/\/daniel.haxx.se\/blog\/2026\/01\/26\/the-end-of-the-curl-bug-bounty\/\" target=\"_blank\" rel=\"noopener nofollow\">&#8220;starting 2025, the confirmed-rate plummeted to below 5%&#8221;<\/a> \u2014 not even one in twenty was real \u2014 and the project shut its bug bounty on 31 January 2026 after 87 confirmed vulnerabilities and over $100,000 paid out. Nothing about curl&#8217;s security changed. What changed is that producing a plausible-looking report stopped costing anything. That is the same thing that has quietly happened to every artifact in your candidate pipeline.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An artifact carries signal only while it is expensive to produce. Generation cost collapsed; signal collapsed with it.<\/li>\n\n\n\n<li>curl&#8217;s confirmed-vulnerability rate went from north of 15% to below 5% in a single year, and the bounty closed rather than absorb the noise.<\/li>\n\n\n\n<li>Gartner expects 1 in 4 candidate profiles worldwide to be fake by 2028; 6% of 3,000 surveyed candidates already admitted to interview fraud.<\/li>\n\n\n\n<li>Screen for what stays costly to fake: provenance over time, live explanation, and behaviour under a changed requirement.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What happened to curl is happening to your inbox<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The curl case is unusually clean because the project publishes its numbers. A bug bounty is a proof-of-work system in miniature: a stranger submits an artifact asserting they found something real, and a maintainer spends scarce time deciding whether to believe it. That trade held for years at better than one in six, then stopped holding inside twelve months \u2014 the load on the security team had come to exceed the value of the genuine findings buried in it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your applicant pipeline is the same system with worse instrumentation. You publish no confirmed rate, so the decay shows up as founders quietly spending more hours per hire and trusting the results less. The mechanism is identical: once producing a convincing claim costs nothing, the claim stops being evidence and becomes noise you have to pay to filter.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The artifact stack that used to be the filter<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Think about what a strong junior candidate looked like three years ago. A README explaining the tradeoffs. An architecture diagram. A write-up of what broke and how it was fixed. An impact summary with a number attached. Each was a decent proxy, not because the artifact mattered, but because producing it took hours only someone who had done the work would spend. That premise is gone. The whole stack is now an afternoon&#8217;s work for a candidate who did none of the underlying engineering \u2014 and the coaching industry actively teaches students to assemble exactly that stack, complete with impact metrics they cannot defend.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The volume data makes the filtering problem concrete. GitHub&#8217;s Octoverse 2025 reports <a href=\"https:\/\/github.blog\/news-insights\/octoverse\/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1\/\" target=\"_blank\" rel=\"noopener nofollow\">121 million new repositories created in 2025, over 36 million new developers joining in a single year, and nearly 80% of new developers using Copilot in their first week<\/a>. On the application side, <a href=\"https:\/\/www.hrdive.com\/news\/fake-job-candidates-ai\/757126\/\" target=\"_blank\" rel=\"noopener nofollow\">Gartner predicts that by 2028 one in four candidate profiles will be fake, and found 6% of 3,000 surveyed candidates admitting to interview fraud while around 40% reported using AI during the application process<\/a>. Note the split: the fraud number is small, the AI-use number is large. Most of your pipeline is not lying to you. It is presenting generated confidence you have no cheap way to price.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/08\/cheap-claims-costly-evidence-opt-1024x576.jpg\" alt=\"cheap-claims-costly-evidence\" class=\"wp-image-205\" srcset=\"https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/08\/cheap-claims-costly-evidence-opt-1024x576.jpg 1024w, https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/08\/cheap-claims-costly-evidence-opt-300x169.jpg 300w, https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/08\/cheap-claims-costly-evidence-opt-768x432.jpg 768w, https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/08\/cheap-claims-costly-evidence-opt-1536x864.jpg 1536w, https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/08\/cheap-claims-costly-evidence-opt.jpg 1600w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Signal is whatever is still expensive to fake<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The useful reframe is to stop asking &#8220;is this impressive&#8221; and start asking &#8220;what would it have cost to fake this&#8221;. Three things survive that test. <strong>Provenance over time<\/strong> \u2014 a commit history with real gaps, reverts and review comments spread across months is far harder to manufacture retroactively than a polished snapshot. <strong>Live explanation<\/strong> \u2014 asking someone to walk through one decision they made and one they rejected, unscripted, collapses the gap between having done the work and having described it. <strong>Behaviour under change<\/strong> \u2014 hand over an ambiguous requirement and watch whether they ask the clarifying question or confidently build the wrong thing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">None of that requires banning AI tools, which would be both unenforceable and beside the point. A candidate who ships faster with good tooling is worth more, not less. What you are pricing is judgment about the output \u2014 whether they can tell when something is off before they can explain why \u2014 and that is the one input the tools do not supply. We made the longer version of that argument in <a href=\"https:\/\/tierones.io\/blog\/hiring-junior-developers-judgment-ai\/\">the gap you&#8217;re now hiring for<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Eight checks before you believe a student&#8217;s project<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Open the deployment, not the repository.<\/strong> A link a stranger can use, with real usage behind it, is the single most expensive artifact on this list to fake.<\/li>\n\n\n\n<li><strong>Read the commit history, not the README.<\/strong> Look for months of uneven work, reverts, and messages written to a future maintainer. A repository born fully formed in three commits tells you what it is.<\/li>\n\n\n\n<li><strong>Ask for the business question first.<\/strong> If they cannot state what decision the project changes, the accuracy number attached to it means nothing.<\/li>\n\n\n\n<li><strong>Ask for the baseline, then probe one number.<\/strong> A result without a comparison is a claim; the best answer is that the simple version \u2014 a query, a heuristic, a rule \u2014 was tried first and beaten. Then ask how one quoted figure was measured, over what period, against what.<\/li>\n\n\n\n<li><strong>Run the two-and-a-half minute walkthrough.<\/strong> Problem, data and its difficulties, approach and why, result and impact, what runs in production. Thirty seconds each, live. Cheap to administer, hard to perform without the underlying work.<\/li>\n\n\n\n<li><strong>Change one requirement mid-conversation.<\/strong> Ask what breaks if the input doubles or the constraint flips, then point at one line and ask why it is there \u2014 the decision, not the syntax. Code someone cannot explain is code they did not decide on.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Move the verification off your desk<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every check above works, and every one costs a founder or senior engineer time per candidate at the top of the funnel \u2014 precisely the trade curl decided was no longer worth making. The structural fix is to verify once, upstream, so what reaches you is already checked rather than asserted. That is what Tierones is: an Tier-1-only network of second-year developers from India&#8217;s IITs, NITs and IIITs where identity, institute and shipped work are verified before a company sees a profile. If you would rather see the work than screen for it, the <a href=\"https:\/\/tierones.io\/blog\/six-week-internship-work-trial\/\">six-week work trial<\/a> is the version with consequences attached, and <a href=\"https:\/\/tierones.io\/students\">Tierones profile<\/a> shows what gets checked.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Why has proof of work stopped working as a hiring signal?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Because the artifacts that carried the signal became cheap to produce. A README explaining tradeoffs, an architecture diagram and a confident impact summary can be generated in an afternoon, so their presence no longer separates a candidate who did the work from one who did not. curl saw the same collapse in security reports \u2014 confirmed vulnerabilities fell from north of 15% to below 5% in 2025, and the bounty closed on 31 January 2026.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How do I verify a junior candidate&#8217;s project is really theirs?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Check provenance, then comprehension. Commit history spread over months, issues and review comments they responded to, and a live deployment are all expensive to fabricate after the fact. Then ask them to walk through one decision they made and one they rejected, unscripted \u2014 a short live walkthrough of problem, approach, result and what they would change catches most of what a polished repository hides.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Should I ban AI tools in technical screening?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No, and it would not work \u2014 around 40% of candidates already report using AI during the application process and nearly 80% of new GitHub developers use Copilot in their first week. Banning it screens for compliance, not competence. State the tool policy explicitly, then design the assessment so the answer is not the deliverable: judgment about the output and handling of an ambiguous requirement are what you are buying.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Hiring for a small team and tired of pricing claims you cannot check? <a href=\"https:\/\/tierones.io\/employers#hire\">Tell us what you need<\/a> \u2014 we&#8217;ll show you proof, not CVs.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>curl&#8217;s valid bug-report rate fell from 15% to under 5%; Gartner expects 1 in 4 candidate profiles fake by 2028. Screen for what&#8217;s costly to fake.<\/p>\n","protected":false},"author":1,"featured_media":203,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[135,134,12,9,57,137,136,103],"class_list":["post-198","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-for-employers","tag-ai-generated-applications","tag-candidate-verification","tag-hiring","tag-proof-of-work","tag-remote-interns","tag-startup-hiring","tag-technical-screening","tag-work-trial"],"_links":{"self":[{"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/posts\/198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/comments?post=198"}],"version-history":[{"count":1,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/posts\/198\/revisions"}],"predecessor-version":[{"id":206,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/posts\/198\/revisions\/206"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/media\/203"}],"wp:attachment":[{"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/media?parent=198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/categories?post=198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/tags?post=198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}