Log inSign up
Image
user avatar
Spearbit
@spearbit
Industry Leading Web3 Security. Request a security review here ➡ cantina.xyz/solutions/spea…
cantina.xyz/solutions/spea…
Joined October 2021
33
Following
14.3K
Followers
RepliesArticlesMedia
  • user avatar
    Spearbit
    @spearbit
    Jul 2
    A normal audit ends with a report. Our review of @arkisxyz ends with a signature that can block the deploy. We recompile the build, confirm the bytecode matches what ships, then sign that exact release by name in a public log. No signature, no release. The Spearbit half of our
    Image
  • user avatar
    Spearbit
    @spearbit
    Jul 2
    This is a real shift for onchain security. The audit report is no longer the deliverable. A named, independent signature on the exact code that ships becomes the gate, recorded in a public log, and without it the release cannot proceed. Proud to be the independent verification
  • user avatar
    Spearbit
    @spearbit
    May 20
    Five household-name eng orgs hit in three weeks by the same group. A worm built for npm ended up walking ~3,800 internal repos out of GitHub.
    user avatar
    Cantina 🪐
    @cantinasecurity
    May 20
    We’ve detected that @github has been compromised by TeamPCP. A poisoned VS Code extension on an employee device. ~3,800 internal repos exfiltrated. Data already on a black forum for $50K. The technical vulnerability is two words: "runOn": "folderOpen" in a .vscode/tasks.json.
    Image

  • See @spearbit's full profile

    Sign up
    Log in