> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trustblock.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> What changed on Trustblock, newest first: Beta v2.0, then dated entries by month from 1 September 2026. Every line links to the page it is about.

**Beta v2.0**

Figures below are the public ones the landing page shows on 20 October 2026.

###  Every report is typed

* Each published report has a kind, and each audit report a type: audit, audit competition or formal verification. [How Trustblock classifies security reports](/methodology/classify-security-reports)
* Penetration tests of off-chain systems, automated scans and named re-audit versions are not counted as audit reports. [What is not an audit](/methodology/classify-security-reports#not-an-audit)
* On the record today: 9,797 audit reports, 59 security firms, 6,605 projects. [All projects, A to Z](https://app.trustblock.run/projects)

###  One severity scale across firms

* 4,268 findings that their firms graded as gas, QA or best practice are marked Informational. Informational findings are listed on the page and never counted as open. [Aave v3 findings](https://app.trustblock.run/project/aave)
* Findings that firms mark acknowledged are labelled "Acknowledged" and kept apart from fixed ones. [Beta v1.9.0](/changelog/1.9.0)

###  The record on contract pages

* The Etherscan card answers for contracts on 26 explorers run by Etherscan, checked on 19 October. [Explorer cards](/technical/explorer-cards)
* Blockscout's Trustblock widget is enabled on 7 chains: Ethereum, OP Mainnet, Polygon, ZKsync Era, Base, Arbitrum One and Scroll. [Blockscout card](/technical/endpoints/get-blockscout-card)
* The card also reads "Verified source. Powered by Etherscan.io APIs" on Etherscan contracts and "Verified source" on Sourcify ones. [Explorer cards](/technical/explorer-cards)

###  Playground: three embeds with code you can copy

* The project label, the security firm widget and the contract page card each have a tab with the embed code and a live preview. [Playground](https://app.trustblock.run/playground)
* The label has layouts (standard, compact, card), light, dark and auto themes, sizes, shapes, accents and up to five facts of your choice. [Show your record on your site](/technical/show-your-record)
* The label is also an image (`label.svg`), for READMEs and docs hosts that run no scripts. [The label as an image](/technical/show-your-record#the-label-as-an-image)
* The security firm widget shows a firm's figures, with options for the figures, layout and theme. [Security firm widget](/technical/metrics-widget)

###  Pages

* Project pages show the record in sections (Audits, Findings, Incidents, Contracts) and each project has a contracts page. [Aave](https://app.trustblock.run/project/aave)
* Firm pages carry the firm's figures, its chains, its reports by project and a "Request an audit" link to the firm's own website. [Certora](https://app.trustblock.run/auditor/certora)
* The security firms list is A to Z on one page. [Security firms](https://app.trustblock.run/auditors)
* Firms can claim their profile with an email on the firm's domain. [Claim a profile](https://app.trustblock.run/claim/certora)

###  API and docs

* Audits in the public project route carry optional fields: `kind`, `auditType`, `firmTerm`, `versionOf`, `seriesId` and `includesFormalVerification`. [Security Data API](/technical/security-api)
* The OpenAPI file is served at one address. [openapi.yml](https://api.trustblock.run/openapi.yml)
* New docs pages: the classification method, a guide to showing your record, and the list of Aave v3 on Ethereum audits per reserve. [Aave v3 on Ethereum](/lists/aave-v3-ethereum)
* `llms.txt` states the record and where to start. [llms.txt](https://app.trustblock.run/llms.txt)

###  Incidents

* Incidents are attached only when they match the project by contract address, and amounts follow DefiLlama and rekt.news where they agree. [Incident rule on the card](/technical/explorer-cards#the-five-cards)

###  Pages under load

* Pages and public fetches refresh once a day, and an audit or firm change refreshes the pages it touches. [Security firms](https://app.trustblock.run/auditors)
* The API's search and list routes have page-size caps, and pages ask a busy API again instead of failing. [Playground](https://app.trustblock.run/playground)

**October 2026**

Dates are the day a change reached the main branch. Counts were read from production on 20 October.

### 20 October

* Reports are typed, and the reports that are not audits are out of every count. [Classification method](/methodology/classify-security-reports)
* A report's line states its type and the firm's own term for it, for example "Audit · firm's term: security review". [Versions and series](/methodology/classify-security-reports#versions-and-series)
* New list: Aave v3 on Ethereum, audits per reserve. [Aave v3 on Ethereum](/lists/aave-v3-ethereum)

### 19 October

* 4,268 findings moved to Informational. [Aave](https://app.trustblock.run/project/aave)
* The header Search button does nothing on an empty field, instead of opening a results page for "undefined". [Projects](https://app.trustblock.run/projects)
* The security firms list is A to Z; contract lines read "Verified source. Powered by Etherscan.io APIs". [Security firms](https://app.trustblock.run/auditors)

### 14 October

* The project label shows the project's three strongest facts and offers more facts, layouts and an image form. [Show your record on your site](/technical/show-your-record)
* Project pages show the record in sections, and each audit has its own page. [Aave](https://app.trustblock.run/project/aave)
* Informational findings are listed and never counted. [Aave](https://app.trustblock.run/project/aave)
* Firms can claim their profile. [Claim a profile](https://app.trustblock.run/claim/certora)
* The Playground's tabs switch in the browser, and the project and firm fields suggest names as you type. [Playground](https://app.trustblock.run/playground)
* `llms.txt` carries the record framing, the FAQ answers and what each page's first sentence states. [llms.txt](https://app.trustblock.run/llms.txt)
* New docs guide: show your record on your site. [Guide](/technical/show-your-record)

### 13 October

* Firm pages have a "Request an audit" link to the firm's website. [Certora](https://app.trustblock.run/auditor/certora)
* The security firm widget has options (figures in order, layout, theme), and the Playground's firm field suggests firms. [Security firm widget](/technical/metrics-widget)
* Project, audit and firm pages open with a dated answer sentence, which is also their meta description. [Aave](https://app.trustblock.run/project/aave)
* Only the latest changelog page is indexed by search engines. [Beta v1.9.0](/changelog/1.9.0)

### 11 October

* The app calls firms "security firms" in the header, footer, list, sign-up and project records. [Security firms](https://app.trustblock.run/auditors)
* The home page opens with the projects table. [Projects](https://app.trustblock.run/)
* One line describes Trustblock everywhere: "The open data layer for web3 security." [Introduction](/introduction)
* A firm's own page can carry the line "Compiled by Trustblock from public reports" when Trustblock keeps the profile. [Certora](https://app.trustblock.run/auditor/certora)

### 10 October

* "Show this on your site": a label configurator on the project page, with a live preview. [Aave](https://app.trustblock.run/project/aave)
* A firm that is no longer active says so on its page. [ack3](https://app.trustblock.run/auditor/ack3)
* The firm widget shows the same value figure as the firm page. [Security firm widget](/technical/metrics-widget)

### 9 October

* Firm pages carry figures computed by one method. [Security firms](https://app.trustblock.run/auditors)
* 15 more Etherscan mainnets are supported chains. [Supported chains](/technical/supported-chains)
* Off-chain scopes read in plain words, and firm pages show a chain bar. [Certora](https://app.trustblock.run/auditor/certora)
* Incidents read "Incident" on project pages, the dashboard and the card. [Explorer cards](/technical/explorer-cards#the-five-cards)
* Acknowledged critical findings are amber and read "not fixed". [Explorer cards](/technical/explorer-cards#the-five-cards)

### 8 October

* The header has one set of links and the footer one shared footer on the public pages. [Projects](https://app.trustblock.run/)
* Security firms are listed A to Z on one page. [Security firms](https://app.trustblock.run/auditors)
* The Playground has a code block per embed, and the label words are aligned: no bare "Audited", a default "Last audit" line. [Playground](https://app.trustblock.run/playground)
* Project pages open with a record head. [Aave](https://app.trustblock.run/project/aave)

### 7 October

* Project and audit sitemap entries carry dates. [Projects](https://app.trustblock.run/projects)

### 6 October

* The label has options (variant, colour, mode, hide-not-found) and the Playground has a card tab. [Labels Widget](/technical/labels-widget)

### 5 October

* One public Playground with three tabs (project label, security firm widget, explorer card). [Playground](https://app.trustblock.run/playground)
* Hijacked or parked project websites are no longer shown on cards and pages. [Projects](https://app.trustblock.run/projects)
* The Privacy page names the service providers the sites use. [Privacy](https://app.trustblock.run/privacy)

### 3 October

* XRPL and 10 more Etherscan chains are supported. [Supported chains](/technical/supported-chains)
* The developer dashboard shows your key, a "Test my key" button and your last calls. [Security Data API](/technical/security-api)
* Terms and Privacy answer on app.trustblock.run. [Terms of Use](https://app.trustblock.run/terms)

### 2 October

* The audits, firms and projects Trustblock quotes use one definition. [Classification method](/methodology/classify-security-reports#counting)
* Both explorer cards carry a contract line when an audit's scope names the address. [Explorer cards](/technical/explorer-cards#the-contract-line)
* Trustblock-managed profiles are listed on /auditors, each labelled as managed by Trustblock. [Security firms](https://app.trustblock.run/auditors)

### 1 October

* Twelve Cosmos-ecosystem chains are supported. [Supported chains](/technical/supported-chains)
* The widget became the free label: no account, no key. [Labels Widget](/technical/labels-widget)

**September 2026**

Dates are the day a change was merged. Reports from these security firms were added to the record for the first time in September: Halborn, Certora, Cyfrin, Sherlock, Pashov Audit Group, Zellic, Trail of Bits, Cantina, Sigma Prime, Ackee Blockchain Security, Decurity, Hexens, Oak Security and PeckShield. In October: ABDK Consulting, ack3, BlockSec, Composable Security, MixBytes, Secure3, Statemind and WatchPug. [Security firms](https://app.trustblock.run/auditors)

### 30 September

* Findings can be recorded as acknowledged, labelled on project pages and in the API. [Beta v1.9.0](/changelog/1.9.0)
* The card text is shorter and says "No audit on Trustblock" when there is none. [Explorer cards](/technical/explorer-cards#the-five-cards)
* Projects may have no chain ("Chain not stated"). [Beta v1.9.0](/changelog/1.9.0)
* Sign-up asks who you are first, then shows the shortest form for that role. [Beta v1.9.0](/changelog/1.9.0)
* Pages ask again when the API answers that it is busy. [Beta v1.9.0](/changelog/1.9.0)

### 25 to 29 September

* Findings carry the firm's own status word beside the Trustblock status. [Beta v1.9.0](/changelog/1.9.0)
* The project page counts and lists the findings that still stand. [Aave](https://app.trustblock.run/project/aave)

### 20 to 24 September

* The OpenAPI file is served from the API domain and checked in the build. [openapi.yml](https://api.trustblock.run/openapi.yml)
* `llms.txt` is served from dated catalogue counts. [llms.txt](https://app.trustblock.run/llms.txt)
* The Blockscout card can say a project has been hit by a recorded incident. [Blockscout card](/technical/endpoints/get-blockscout-card)
* A card that fails says so, instead of reading "no audit". [Explorer cards](/technical/explorer-cards)

### 8 to 21 September

* The Etherscan card's verdict is scoped to the audit it comes from. [Explorer cards](/technical/explorer-cards)
* A lookup that finds nothing no longer costs an API credit. [Security Data API](/technical/security-api)

**Earlier versions**

The version pages from Alpha v0.1.0 to Beta v1.9.0 stay in the sidebar of this tab. [Beta v1.9.0](/changelog/1.9.0) · [Beta v1.8.0](/changelog/1.8.0) · [Alpha v0.1.0](/changelog/0.1.0)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.