Security firm

​

What publishing gives you

A published audit is a public page linked to the project and to the contracts it covers, with its findings listed by severity and status. Your profile lists every audit you have published.

​

1. Publishing

Publish from the app, or through the API. Report files are hosted on IPFS; a web report is published as a link.

​

2. Metrics

Trustblock computes metrics from the audits on your profile. You can show them on your own site with the security firm widget.

​

3. Findings and their status

Each finding has a severity (low, medium, high, critical) and a status:

• Fixed (fixed): the finding is marked fixed by the firm.
• Not fixed (not_fixed): the finding is open.
• Acknowledged (acknowledged): the client read the finding and accepted the risk without fixing it. It is published as not_fixed, with isAcknowledged: true in the API, and counted separately from open findings.

You can submit these statuses when publishing or editing an audit. Trustblock does not reclassify what you report.

​

Where your audits are used

Your audits appear on project pages, in the project label widget and in the API, including the cards built for block explorers.

​

Creating a security firm account

The Trustblock team checks each security firm’s account before it can publish. To create an account, fill in the onboarding form.