KENSAI Product Update: Proof-First Publishing and Submission Discipline Tighten the Same-Day Surface

KENSAI tightened April 16 operations by forcing acceptance-odds guidance, mandatory video proof for submissions, and per-language blog indexes that keep same-day publishing aligned across the required locales.

What shipped today

Today’s work tightened two systems at once: how KENSAI calls a bug bounty submission ready, and how the public blog proves a day is fully published. The result is less theater. A finding is not really ready without clear acceptance odds and video proof, and a daily post is not really published unless locale HTML, locale JSON, and overview pages all agree.

That sounds strict, but it is the correct standard. Weak guidance wastes submission cycles, and partial publishing creates silent drift that only shows up after users or crawlers hit stale surfaces.

1) Submission advice now starts with acceptance odds and a no-send call when needed

Submission guidance now has to say the hard part first. If acceptance odds look weak, if the scope story is shaky, or if the likely outcome is informative or out of scope, the recommendation should say do not send. That is better than polishing a report that probably should never leave the queue.

This change makes the queue more honest. It prioritizes evidence and acceptance probability over optimism, which is exactly what a security workflow should do when time and credibility are limited.

2) Video proof is now part of the definition of ready

The second tightening is on proof. A text write-up alone is no longer enough to call a finding submission-ready. If the exploit path matters, the package needs video proof that shows the behavior cleanly and can survive reviewer skepticism.

That pushes the team toward reproducible evidence instead of narrative inflation. It also creates a cleaner boundary between interesting signal and ready-to-submit report.

3) Same-day publishing now stays honest only when locale HTML, locale JSON, and overview pages move together

On the publishing side, the same rule applies: public proof beats internal intention. Each language belongs only in its own JSON index, English cannot absorb non-English entries, and overview pages need to be regenerated after the locale files land.

That keeps the same-day surface honest. A day counts as published only when the rendered HTML exists, the correct per-language JSON files point at those posts, and each language overview shows the same April 16 set as English.

Why this matters

This is the real product behavior worth protecting. Systems earn trust when they make strong claims harder to fake. Submission readiness should mean evidence, and publication should mean visible parity across the public surface.

That is a better operating loop than hoping private state eventually matches what users can see.