All three keys are live and nobody has found one. Levels 2, 3 and 4 are UNCLAIMED, the Hall of Fame has three open slots, and the first person to open a locket becomes a White Hat in a future version of the game.
The rules moved in three places since the beta, and all three moves went the same direction: fewer surprises at submission time.
The attempt budget got stricter
The beta gave three attempts per level. That was generous enough to make guessing viable, which is the opposite of what this program is for. The rule now reads:
We put that rule everywhere it could possibly be needed, on this site and in the game panel, because a researcher who discovers it at submission time will feel tricked, and this program only works on trust.
Safe harbour is written down
The beta said research was welcome. Welcome is not a commitment, so the bounty page now carries an explicit safe harbour: stay inside the in-scope list and we will not pursue or support legal action, will not contact your employer or your university, and will not ask anybody to take your writeup down.
Publish whenever you like, including before a level is awarded and including if your submission was rejected. Send us the link and it goes on your Hall of Fame entry.
What happens to your email address
A submission needs an address so we can contact you if you win. It is deleted within 90 days of that level being awarded, it is never shown on this site, and submitting a key does not subscribe you to anything. The newsletter is a separate form you have to fill in yourself.
What is not going to change
There is no cash prize. There never was one and inventing one now would be worse than saying so. What you get is your alias, a portrait built with you, one line of dialogue in a future version of the game, and permanent credit in the Hall of Fame.
The keys are in the shipped artifact and reachable from it alone. No ARG, no riddle in the artwork, no clue hidden on this website. It is a reverse-engineering problem and nothing else.