Security practices

• Multi-factor authentication on every account that touches code, infrastructure or client data.
• Code review on every change before it is merged.
• Foundry unit, fuzz and invariant tests for smart contracts, run in CI.
• Automated dependency scanning on our repositories.
• Least-privilege access to client systems, removed when an engagement ends.

Reporting a vulnerability

Email hello@codesensys.com with a description and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it. We do not take legal action against good-faith research.