Proof

Everything below comes from the award transaction itself: the token GitHub signed, and what the contract checked before paying.

Check GitHub's signature yourself

RS256

Your browser fetches the key the contract trusts for this token, then verifies GitHub's signature over the token with WebCrypto. Nothing is sent anywhere.

What the contract checked

From merge to payout

Token GitHub signed

Raw token