Launch app
Write · ModuleIn build

Audit

An AI security audit of a Solana program at a git commit, on a locked seed, with a signed receipt anyone can verify. One run per commit, no re-rolls.

Open in app
The problem it prevents

Fake "audited" badges, and merges with criticals nobody caught before launch.

Who it is for

Token launchers, dev teams and grant programs who want a verdict that cannot be re-rolled until it looks good.

How it works

  1. 01Sign in and give a public GitHub repository, a full commit hash and, optionally, the program folder.
  2. 02The worker hashes the inputs and locks a seed from that commitment and a future Solana block. Nobody can re-roll.
  3. 03A hosted model audits the source. Its output is recorded word for word; the verdict is computed from it deterministically.
  4. 04The whole record is signed with one-time hash-based keys into the public log. Verdict and findings are public.
  5. 05Anyone opens the verify page and their browser re-checks all twelve conditions.

What you get

  • A verdict: Critical, Issues found, Clean or Incomplete.
  • Findings with severity, category, file and lines, description and fix.
  • A signed receipt with a public verify page.
  • A repository badge that links to its proof.

Limits and caveats

  • A receipt proves the audit ran as stated. It does not prove the code is safe.
  • Today's audits use a hosted model. Byte-identical re-runs are a Phase 4 upgrade; nobody can reproduce the same bytes today.
  • Free with limits: 3 per wallet per UTC day, 40 per day in total, one running job per wallet.
  • Anchor or native Rust only; about 400 KB of source at most; public repositories only.
  • Findings are public, and name the bug and the fix only.

Questions

Why can't I run it again on the same commit?

That is the point. A badge means something only if the result cannot be re-rolled. Asking again returns the existing result for free.

What does the receipt prove?

That the inputs were committed before the answer was seen, the answer was recorded unchanged, and the verdict follows from it. Not that the code is safe.

Which model?

One high-recall hosted model per run today. A multi-model "deep audit" tier is Phase 4.

Can I audit a private repository?

Not yet. Private verification by zero-knowledge proof is Phase 9.

How long does it take?

Typically one to two minutes. The page refreshes itself while the job runs.

Audit · ByteGuard