For projects
Sponsoring an audit competition
Run a time-boxed audit of a frozen commit with an independent judge and a published payout formula.
Competitions are best before a launch or a major upgrade: many researchers review the same frozen code over a fixed window.
Launching one
From onboarding or your dashboard, choose Launch an audit competition and provide:
- title, summary and what wardens should know (architecture, trust assumptions, areas of concern),
- the repository and frozen commit,
- in-scope files with nSLOC (one per line:
path, nsloc), - prize pool, start time (UTC) and duration,
- points per severity (defaults: High 10, Medium 3), plus what's out of scope and any known issues.
The rules lock when you publish. Scope, severity criteria and the scoring formula are hashed, and the platform assigns an independent judge from outside your organization.
What wardens get (and why they'll show up)
- Blind judging: the judge sees pseudonyms, not names.
- Reasons for every decision, and transparent duplicate groups.
- One escalation per finding during a 48-hour window before results are final.
- A formula-only payout: no discretionary portion of the pool.
What you get
Every valid finding grouped by root cause and severity, with the best write-up selected per group, and a clear results table.