What to send, and where it goes first
The most valuable thing you can send. Name the artifact — file plus JSON key — so it can be checked in minutes. Start from the replication kit; the claims register maps every headline number to the artifact behind it. Different numbers on your hardware is a finding, not a nuisance.
Economists, security researchers, identity and mechanism-design people. Reviews are hosted unedited, criticisms included — see the ones already published. Say what access you need and what you would want in return.
Funding, introductions, or hands. What the money would do is written down before anyone gives any.
Same address. If you are writing about the project, the independent reviews and the failure log are the least flattering and most accurate places to start.
Prefer to follow along rather than write? The list is free and infrequent — subscribe here. Everything published, including the failures, goes out the same way.