Show your record on your site

Every project on Trustblock has a public security record: the audit reports published for it, their findings with the status each report states, and any incident on record. You can show that record where your users read about you: your site, your docs, your audits page.

Check your record first. Open your project’s page on app.trustblock.run and compare it with the reports you publish yourself. If something is wrong or missing, write to contact@trustblock.run with a link to the report. A missing audit is published by the security firm that conducted it.

Three ways

Way	What you add	What it takes
The label	A script and a `div` on your page, or the label as an image	Free. No account, no key, no sign-in
The API	Your own code, drawing the record from one route	A developer account and its key
A plain link	A link to your project’s page	Nothing

The label

What it states

The label reads the same record as your project page and changes when the record changes. It states what the audit reports on Trustblock say. It never rates the project: no score, no tick, no grade.

Your record	First line	Then
Audits on record, no open critical finding, no incident	”Last audit Aug 2026”	Your record’s facts (see Facts). The Standard layout puts the latest firm on the first line
Open critical findings, in reports whose data Trustblock has checked	”1 open critical finding"	"OpenZeppelin report, Mar 2022”: whose report states it, and its date
Open critical findings, data not checked yet	”Security record on Trustblock”	Your record’s facts
An incident on record	”Incident Mar 2024”	Your record’s facts
No audit on Trustblock	”No audit on Trustblock"	"Not a statement about audits elsewhere”

An open critical finding or an incident is always the first line, whatever facts you choose: the label never shows “Last audit” while the record holds one. The Card layout adds your facts under the open critical line. The label links to your project’s page on Trustblock, where every report and finding can be read.

The code

Add the script once, then a div where the label goes. Your slug is the last part of your project page’s address: app.trustblock.run/project/aave has the slug aave.

<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>

<div
  data-tb-project-widget
  data-tb-project-slug="your-project-slug"
></div>

With no option, the label shows your record’s three strongest facts (Automatic). The same code, with your slug and options already filled in, is on your project’s page under “Show this on your site”, and in the Playground, tab “Project label”. Both show the label as it will draw while you choose.

Options

Each option is one attribute on the div, and the same option is a URL parameter of the label image. Leave an option out to keep its default. A value the label does not know is ignored, and the default is used. The names in the first column are the editor’s.

Option	Attribute (live label)	Parameter (image)	Values
Automatic facts	no `data-tb-show`	no `show`	The default. Your record’s three strongest facts: the last audit (its date and firm) and the two strongest of the facts below. They change when your record changes
Facts	`data-tb-show`	`show`	A comma list of the facts below, such as `date,firm,reports,fixed`, or `none` for the first line alone. Naming facts turns Automatic off
Fixed as	`data-tb-fixed`	`fixed`	`count` (default): “214 of 231 findings fixed”; `percent`: “93% of findings fixed”
Links to	`data-tb-link`	none	`record` (default): your project’s page; or the id of one of your project’s audits (the last part of its page’s address): that audit’s page. The image has no link of its own: wrap it in one
Layout	`data-tb-layout`	`layout`	`compact`: one line, the last audit and 1 fact; `standard` (default): two lines, the last audit with its firm, then up to 2 facts; `card`: up to 5 facts, one a line
Theme	`data-tb-color`	`theme`	`light` (default), `dark`, `auto` (follows the page behind the label; the image draws `auto` light)
Accent	`data-tb-accent`	`accent`	`purple` (default), `blue`, `slate`, `ink`. It colours the mark and the card’s top rule only: an open critical finding or an incident keeps its red mark
Corners	`data-tb-shape`	`shape`	`rounded` (default), `pill`, `square`
Size	`data-tb-size`	`size`	`medium` (default), `small`, `large`
Date	`data-tb-date`	`date`	`month` (default, Aug 2026), `long` (20 Aug 2026), `iso` (2026-08-20), `slash` (2026/08/20)
Language	`data-tb-lang`	`lang`	`en` (default), `fr`, `es`, `de`, `pt`

Three more attributes work on the live label only:

Attribute	Values	What it changes
`data-tb-mode`	`fit`, `fill`	`fill` takes the width of the element around the label
`data-tb-hide-not-found`	no value	Hides the label when Trustblock holds no audit for the project
`data-tb-variant`	`badge`, `label`	`label` is the small form: “Audits on Trustblock” with the latest audit’s firm and date. It takes no other option

Facts

Fact	In `data-tb-show` and `show`	What it draws
Last audit date	`date`	The first line, “Last audit Aug 2026”. Without it, the first line reads “Audits on Trustblock”
Latest firm	`firm`	The firm of the latest audit report
Reports and firms	`reports`	”40 reports, 11 firms”; on a Card, “40 audit reports · 11 security firms”
Findings fixed	`fixed`	”214 of 231 findings fixed”, or “93% of findings fixed” with Fixed as `percent`, as the reports state
First audit year	`since`	”Audits since 2021”
Firm names	`firms`	Up to three firm names, newest first, then “+N”
Chains	`chains`	Up to three chains, then “+N”
Project’s site	`site`	Your project’s domain
Number of audits	`audits`	”12 audits”. Kept for labels embedded before; the editor offers Reports and firms instead

A fact your record does not hold is not drawn: with no finding on record, there is no Findings fixed line. When you name more facts than the layout has room for, it draws them in this order and leaves the rest out: firm, site, audits, reports, fixed, since, firms, chains. The editor names the facts left out. Example: a dark card that states the last audit, the reports and firms, the findings fixed as a percentage and the first audit year.

<div
  data-tb-project-widget
  data-tb-project-slug="your-project-slug"
  data-tb-color="dark"
  data-tb-show="date,firm,reports,fixed,since"
  data-tb-layout="card"
  data-tb-fixed="percent"
></div>

To find the project by its domain or by a contract address instead of its slug, see the labels widget page.

The label as an image

Some places do not run scripts from other sites: GitHub READMEs and several docs hosts. Some teams also keep every outside script off the pages where users connect a wallet. There, use the label as an image:

https://widget.trustblock.run/project/your-project-slug/label.svg

It takes the options above as URL parameters, such as label.svg?layout=card&theme=dark&show=reports,fixed&fixed=percent. It states the same record as the live label, open critical findings and incidents included, and refreshes within the hour. An image has no link of its own, so wrap it in one:

[![Security record on Trustblock](https://widget.trustblock.run/project/your-project-slug/label.svg)](https://app.trustblock.run/project/your-project-slug)

In the editor, “Embed as: Image” gives this code with your options.

If you remove it

Nothing happens. Your record does not change, and Trustblock does not publish that a label was removed.

The API

For a security or audits page you design yourself. One route returns your record: GET https://api.trustblock.run/v1/project/security, by slug, by domain, or by chain and address. It returns the project’s audits, the findings with their status, and any recorded incidents.

curl "https://api.trustblock.run/v1/project/security?slug=your-project-slug" \
  -H "Authorization: Bearer $TRUSTBLOCK_API_KEY"

The key comes with a developer account: create one in three steps (the account type, a code sent by email, your company’s details). Each account has 1,000 credits a month, and each successful call uses one. Reading your record once a day uses about 30. Keep the key on your server, never in your page. The fields are described on the security API page.

A plain link

It needs no code from us and works everywhere, including GitHub READMEs and GitBook.

<a href="https://app.trustblock.run/project/your-project-slug">Security record on Trustblock</a>

[Security record on Trustblock](https://app.trustblock.run/project/your-project-slug)

For security firms

Two embeds come from your work on Trustblock. Your firm widget, on your own site. It shows figures counted from your audit reports on Trustblock and links to your firm page. Choose up to four figures, in your order, in the Playground: it gives the code.

<script src="https://widget.trustblock.run/auditor-widget.min.js" defer></script>

<div
  data-tb-auditor-widget
  data-tb-auditor-slug="your-firm-slug"
  data-tb-layout="card"
  data-tb-metrics="projects,reports,findings,value"
  data-tb-theme="light"
  data-tb-accent="#751dff"
  data-tb-radius="12"
></div>

Attribute	Values
`data-tb-layout`	`card`, `compact`, `strip`
`data-tb-metrics`	Up to four of `projects`, `reports`, `chains`, `years`, `latest`, `value`, `findings`, `critical-high`, `notable`
`data-tb-theme`	`light`, `dark`, `auto`
`data-tb-accent`	A colour, such as `#751dff`
`data-tb-radius`	The corner radius in pixels, 0 to 24

See also the security firm widget page. A label for a client. Signed in to your firm account, the section “Project label for a client” gives the label code of a project from your published audits, ready to send to that project’s team. The label carries your firm’s name when your report is the latest.

The label, its image, the firm widget and the plain link are free. They need no account, no key and no sign-in.
The API needs a developer account and its key.
Showing the label is your choice. Your record on Trustblock is the same with or without it.

​Three ways

​The label

​What it states

​The code

​Options

​Facts

​The label as an image

​If you remove it

​The API

​A plain link

​For security firms

​Free, and no sign-in

Three ways

The label

What it states

The code

Options

Facts

The label as an image

If you remove it

The API

A plain link

For security firms

Free, and no sign-in