Published audit reports.
Every audit we complete is published here in full, findings and all, with the client’s permission. This page is how you check our work rather than take our word for it.
This register is new
We are an early-stage firm and this page is currently thin. We could have filled it with case studies and testimonials instead; we would rather show you an honest empty register than an impressive-looking one you cannot verify.
It fills up through our free monitoring assessment and paid engagements where clients agree to publication. If that matters to you when choosing an auditor, and it reasonably might, a larger firm with hundreds of published reports is a defensible choice, and we will say so on a call.
What gets published
- The complete report, including findings we rated informational.
- The commit hash reviewed, so anyone can check what was and was not in scope.
- The remediation status of every finding at the time of publication.
- An explicit statement of what the review did not cover.
What never gets published
Anything without written client permission. Anything with an unfixed critical or high finding on a live contract: we hold those until remediation, or until the client tells us to publish anyway. Anything that would identify a client who has asked to stay anonymous.
Following our contest work
Alongside client engagements, our auditors submit findings to public audit contests. Those findings are permanently public and independently verifiable, which makes them a useful signal while this register is still building. We link to them from the research blog as they are published.
Help us fill this page.
A free snapshot costs you nothing and, if you agree to publication, gives both of us something verifiable to point at.
- Reply written by the auditor who read your code
- No sales sequence, no drip campaign, no retargeting
- We’ll tell you if you don’t need a paid audit yet
- Report published only with your written permission