Docs

Every section of the PDF + verify page explained.

Your audit deliverable has three artefacts. Here's how to use each.

1. The signed PDF

Open from the email or Account → Audits → → Download PDF.

Sections:

  1. Cover — methodology version, audit ID, signing key fingerprint.
  2. Executive Summary — 1-page overview your CTO can paste into a board doc.
  3. Findings — each finding has:
    • Severity (Critical / High / Medium / Low / Info)
    • Plain-English description
    • Code excerpt with line numbers
    • Reproducer (Deep Dive only)
    • Remediation guidance
  4. Threat Model (Deep Dive only) — narrative analysis of the contract's failure modes.
  5. Methodology Citations — every finding maps back to a section of qortrace-method-v0.2.
  6. Appendix — file inventory, line counts, compiler version detected.

The PDF is signed with our audit signing key. Anyone can verify authenticity by uploading it at /verify.

2. The public /verify/<id> page

Share this URL in your README, vendor questionnaires, or marketing collateral. It shows:

  • The audit overview (verdict, severity counts, methodology version)
  • Confirmation the PDF hasn't been tampered with
  • A link to the full PDF
  • An anonymised view-counter (helps you measure trust signals)

It does not show your source code or anything beyond what's already in the PDF.

3. The embeddable certificate SVG / PNG

A drop-in badge for your README or website. Choose between:

  • Compact pill (60×24 px) — sits next to your CI badges
  • Full card (560×320 px) — banner for marketing pages
  • Watermarked vs clean — pick on the audit detail page

Both formats are dynamically rendered from /api/audits/{id}/badge.svg so they always reflect the latest version.

How to act on findings

Severity ladder:

  • Critical → Fix before any deployment. We won't sign Deep Dive reports if Criticals remain unaddressed.
  • High → Fix in the same sprint. Document any wontfix decisions.
  • Medium → Track in your backlog, fix within a quarter.
  • Low / Info → Polish; not blocking.

Each finding includes a recommended fix. If our suggestion conflicts with your design, document the rationale in your repo — auditors love seeing that thought process.