We align scope boundaries, assumptions, threat model, and timelines before line-by-line review begins.

Input

Repo, docs, deployment plan

Output

Signed audit scope memo

Coverage focuses on exploitability, invariant safety, privilege boundaries, and economic abuse paths.

• Function-level logic and state-transition checks.
• Access-control, upgradeability, and initialization flows.
• Edge-case simulation and adversarial scenario testing.

Each issue is documented with attack narrative, impact, reproducibility context, and pragmatic fix direction.

After fixes are shipped, we re-verify affected paths and close the loop with clear status on each finding.

• Patch diff review
• Retest of exploit path
• Residual risk notes
• Final status matrix