Trail of Bits

Compare implementation code with a specification, whitepaper, or design document. It checks individual requirements, independently challenges reported mismatches, and writes evidence-based reports covering missing or partial implementation, contradictions, undocumented behavior, and requirements that cannot be judged.

中文简介正在准备中。当前显示英语简介。

• Check an implementation against a specification
• Compare protocol code with a whitepaper
• Verify guarantees stated in a README

Review Cairo smart contracts on StarkNet for six vulnerability patterns involving arithmetic, cross-layer messages, addresses, and signature reuse. Receive a coverage table with evidence for every pattern, plus severity ratings and fixes for identified issues.

中文简介正在准备中。当前显示英语简介。

• Review StarkNet contracts before launch
• Audit L1-L2 bridge message handling
• Check protection against signature reuse

Runs repeated reviews and fixes on a Claude Code skill until no critical or major findings remain. Tracks findings across rounds, checks change boundaries, and stops for a design decision when fixes stop making progress.

中文简介正在准备中。当前显示英语简介。

• Refining a skill until critical and major findings are resolved
• Improving skill metadata, trigger descriptions, and references
• Tracking recurring findings across review rounds

Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.

中文简介正在准备中。当前显示英语简介。

• Reviewing signing and encryption routines
• Checking division involving secret values
• Inspecting authentication tag comparisons

Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.

中文简介正在准备中。当前显示英语简介。

• Scanning a codebase for security vulnerabilities
• Tracing untrusted input through custom APIs
• Choosing broad or high-precision security scans

Reviews Rust applications and libraries for security issues involving unsafe code, memory safety, concurrency, calls across language boundaries, panics, and async runtimes. Coordinates specialized reviewers and produces Markdown and SARIF reports, a format for analysis tools.

中文简介正在准备中。当前显示英语简介。

• Auditing unsafe Rust code
• Reviewing calls across language boundaries
• Checking concurrency and async runtime hazards

Create an interactive HTML guide to a branch’s code changes, with complete file diffs arranged in a logical reading order, explanations of design choices, and review findings labeled by severity.

中文简介正在准备中。当前显示英语简介。

• Understanding a branch’s changes in a logical order
• Reviewing diffs alongside design explanations
• Checking findings labeled by severity

Process SARIF files, a standard format for static analysis results, to filter alerts, remove duplicates, combine findings from multiple tools, and produce reports. It also supports comparing runs and integrating result checks into CI/CD pipelines.

中文简介正在准备中。当前显示英语简介。

• Combine findings from multiple security scanners
• Filter alerts by severity and remove duplicates
• Compare earlier and current results for new issues

Review Substrate and Polkadot runtime modules, called pallets, for seven security patterns, including unsafe arithmetic, crashes, incorrect processing costs, and weak permission checks. Produce a complete coverage table, findings with code references, and proposed fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing custom Substrate pallets
• Reviewing processing costs and fees
• Checking permissions for privileged operations

Review smart contract security through five steps covering Slither scans, special features, diagrams, documented safety conditions, and manual checks. Get project-specific findings, testing setup guidance, and a prioritized action plan for development or deployment reviews.

中文简介正在准备中。当前显示英语简介。

• Review smart contract security before deployment
• Triage Slither findings and false positives
• Visualize inheritance and access permissions

Create an isolated development container configured for Claude Code and the project's languages. Generate container files, editor settings, dependency setup commands, and persistent storage for Python, Node/TypeScript, Rust, and Go projects.

中文简介正在准备中。当前显示英语简介。

• Add devcontainer support to a project
• Set up an isolated Claude Code workspace
• Configure development tools for a multilingual project

Review native C/C++ applications and services for memory errors, integer overflows, and race conditions, where concurrent operations interfere. Coordinate multiple reviewers and produce findings with severity ratings, alongside reports of missing or unverified review coverage.

中文简介正在准备中。当前显示英语简介。

• Audit a native C/C++ application for security flaws
• Review a daemon or service for memory safety
• Investigate integer overflows and race conditions

Get independent code reviews of uncommitted changes, branch differences, or individual commits using Codex or Antigravity. Receive findings with severity, locations, impact, and suggested corrections, and compare where the two reviewers agree or differ.

中文简介正在准备中。当前显示英语简介。

• Reviewing uncommitted changes for bugs
• Comparing Codex and Antigravity on the same branch diff
• Reviewing a specific commit for security issues

Review token contracts and the protocols that accept them for ERC20/ERC721 compliance, privileged controls, and unusual transfer behavior. Produces evidence-based risk assessments and prioritized fixes, with supply and holder analysis when deployed contract details are provided.

中文简介正在准备中。当前显示英语简介。

• Checking ERC20/ERC721 implementations against their standards
• Reviewing support for tokens with unusual transfer behavior
• Assessing administrator powers and upgrade risks

Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.

中文简介正在准备中。当前显示英语简介。

• Reviewing dependency risks before an engagement
• Checking advisories across a lockfile dependency tree
• Finding abandoned or archived dependencies

Write or modernize C++ with guidance on C++20, C++23, and C++26 features. Review memory ownership, error handling, and template constraints, with recommendations for compiler protections and runtime checks that detect bugs.

中文简介正在准备中。当前显示英语简介。

• Modernize legacy C++ patterns
• Choose approaches for new C++ code
• Review memory ownership and error handling

Use a randomized tarot spread to guide loosely defined tasks or choose among reasonable approaches. It interprets 36 cards across 12 areas, turning their themes into concrete next steps and possible investigation angles.

中文简介正在准备中。当前显示英语简介。

• Choosing an approach for a casually delegated task
• Breaking a tie between reasonable options
• Finding a new angle when planning stalls

Prepares a project for open-source release by checking sensitive history, licensing, documentation, tests, and automated publishing. Helps identify gaps so people outside the project can build, use, and contribute to it.

中文简介正在准备中。当前显示英语简介。

• Preparing a private repository for public release
• Choosing and documenting a project license
• Improving README and contribution instructions

Search HTTP traffic and security findings stored in Burp Suite project files from the command line. Filter response headers or bodies with text patterns, extract affected URLs, and review selected proxy history or site map data.

中文简介正在准备中。当前显示英语简介。

• Finding CORS or other response headers in captured traffic
• Filtering security findings by severity and confidence
• Extracting URLs from proxy history

Organize open GitHub issues and pull requests using the gh CLI, GitHub's command-line tool. Identifies resolved issues and pending fixes, estimates priorities and change sizes locally, and proposes closures, links, reviews, or merges for approval.

中文简介正在准备中。当前显示英语简介。

• Clean up resolved issues left open
• Link issues to pull requests with pending fixes
• Estimate priorities and change sizes for outstanding work

Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for recurring bug patterns
• Tracking untrusted input reaching dangerous operations
• Enforcing coding standards with custom rules

Build a documented understanding of unfamiliar code before a security audit. It records function assumptions, guarantees, dependencies, and open questions, producing a dossier and individual function notes to support later vulnerability analysis.

中文简介正在准备中。当前显示英语简介。

• Understanding unfamiliar code before an audit
• Mapping dependencies for threat modeling
• Preparing background notes for an architecture review

Runs repeated PR reviews and fixes on the directories changed by the current branch. Uses an installed reviewer, checks editing scope after each round, and reports whether blocking findings were resolved or the loop stopped.

中文简介正在准备中。当前显示英语简介。

• Cleaning up a branch before opening a pull request
• Fixing review findings before updating a pull request
• Repeating reviews after each fix

Review TON smart contracts written in FunC for three security patterns: incorrect boolean values, unverified Jetton token notifications, and forwarding funds without reserving execution fees. Receive a coverage table, source references, severity ratings, and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Review FunC boolean logic
• Check sender validation in Jetton transfer notifications
• Inspect forwarded TON amounts and execution fee reserves