Applications
Design review, code review, penetration testing and API authorisation — sold as a ladder you climb, not one product.
- Threat model and design review
- Secure code review
- Application penetration test
- API and integration review
Application & digital asset assurance
Forty thousand lines.
Three that matter.
We review application code and cryptocurrency systems the way an attacker would, and tell you exactly which findings will actually be used against you.
- Lines of code reviewed
- 340k
- Critical findings issued
- 61
- Value secured under review
- $2.1bn
About us
A report with ninety findings is not a better report.
The name is Latin. Cernere — to sift, to separate one thing from another. It is the root of discern, and of certain. It is also, precisely, the job.
Length is easy to produce. What you need is the short list: the findings an attacker can actually reach, the path to each one so your engineers can verify it themselves, and a straight answer on which of the rest you can safely leave.
View more“Security is not about seeing more. It is about separating what matters from what doesn’t.”
What we do
Three columns. One discipline.
Digital assets
Smart contracts, protocol economics, custody and exchange operations. On-chain and off, because the two attract different buyers and different attacks.
- Smart contract audit
- Protocol and economic design review
- Custody and key management review
- Wallet security review
Cryptography and keys
The work that proves the other two are one discipline. Implementation review, key management architecture, and the pipeline that signs your builds.
- Cryptographic implementation review
- Key management architecture
- Software supply chain and signing
Step by step
How we work, in four moves
We start with what an attacker wants and what your system is worth to them. That decides where the days go, not the line count.
Manual review by people who have built this kind of system. Tools find the patterns; the findings that matter come from reading the code.
Every critical finding carries the path to reach it. Where we cannot demonstrate exploitability we grade it honestly rather than inflate the report.
Once you have remediated we verify each finding and issue a signed addendum. It is in the original fee, never billed as a second engagement.
Step 01 / 04
Use cases
What an engagement looks like
Digital assets
/ Smart contract audit · 10–15 days
A lending protocol before mainnet
Reentrancy and access control first, then the economics of liquidation under a stale oracle.
Outcome
2 critical, 5 high
Both criticals were reachable from a public entry point. Fixed and re-tested inside the same engagement.
Custody
/ Key management review · 8–12 days
An MPC signing service
Threshold policy, signer separation and the seed ceremony behind a platform taking client funds.
Outcome
1 quorum flaw
A recovery path let two operators reconstruct a signing key alone. Closed before the platform took custody.
Fintech
/ API review · 5–10 days
A payments backend adding digital assets
Authorisation across service boundaries, where the criticals in this kind of system usually live.
Outcome
31 endpoints
Re-authorised against a single policy. No cross-tenant path left reachable at re-test.
Start here
Request a scope call. We tell you what it needs.
Tell us what the system is and what you are worried about. The call takes about thirty minutes and ends with a fixed-scope, fixed-fee proposal. It costs nothing and we do not send a salesperson.
- hello@cernosec.com
- Response time
- One working day.