CD Security

• Name: CD Security
• URL: https://cdsecurity.io/
• Category: boutique security-review company / public audit-report operator / audit-readiness workflow company
• Summary: CD Security belongs in companies/, not projects/, because the useful question is not just what audit PDF exists? but which named operator scopes the review, staffs it with senior auditors, decides what becomes a public report, publishes pre-audit readiness guidance, and packages an audit-prep workflow that other teams may start treating as part of their security baseline? The practical leverage sits in the company-run review and publication boundary: who gets staffed, how findings are validated and presented, what baseline readiness is normalized before an audit starts, and which public artifacts downstream builders can reuse.
• What it does:
  • Performs smart-contract security reviews for web3 projects, emphasizing manual review, targeted fuzzing, and protocol-aware testing across Solidity, Rust, Move, Cairo, and TypeScript
  • Positions itself as a deliberately small, senior-heavy firm founded by two independent auditors rather than a broad headcount-scaled audit marketplace
  • Maintains a public GitHub audit-portfolio repository with many linked PDF reports across DeFi, bridges, staking, RWAs, insurance, and other protocol categories
  • Publishes explicit pre-audit guidance that pushes teams toward internal review, multiple external audits before launch, documentation readiness, and incident-response planning
  • Ships audit-prep, a first-party readiness workflow that checks testing, documentation, hygiene, dependencies, deployment, and project-context quality before a formal audit
  • Uses public report publication and audit-readiness framing as part of the trust surface rather than keeping all methodology behind private client delivery
• Key claims:
  • The homepage says CD Security aims to stop multi-million-dollar breaches by uncovering vulnerabilities in protocol code before attackers do, which is simple marketing but still clearly frames a named security operator rather than a protocol primitive
  • The about page says CD Security was founded in 2023 by two independent auditors, Chris and Dimitar, and was intentionally built to stay small, sharp, and focused rather than become a very large VC-backed shop
  • The same about page says the firm provides manual code review, targeted fuzzing, and protocol-aware testing across Solidity, Rust, Move, Cairo, and TypeScript, which makes the review-method boundary explicit rather than generic full-service security
  • The about page says the firm works with a pool of experienced auditors, does not use juniors, and says every auditor has 100+ public findings, which is analytically useful because staffing policy itself is part of the assurance surface customers are buying
  • The public audits repository is not a token sample page; it is a structured first-party report archive with many protocol reports, which means publication choice and report framing become part of the practical trust boundary
  • The security-preparation article says the bare-minimum launch baseline should include one internal audit, two external audits before launch, and fresh audits after each code change before deployment, which is exactly the sort of published workflow guidance that can start shaping outside teams’ default habits
  • The audit-prep README says the tool runs an eight-phase readiness check across testing, documentation, hygiene, dependencies, best practices, deployment, and project docs for Foundry and Hardhat projects, which makes CD Security more than a PDF shop: it is packaging pre-audit workflow too
• Whitepaper: No classic standalone CD Security whitepaper is the important artifact here. The clearest primary materials are the official homepage and about page, the public audits repository, the pre-audit guidance post, and the audit-prep README captured in ../whitepapers/cd-security-company-primary-sources-2026-08-09.md.
• Sources:
  • https://cdsecurity.io/
  • https://cdsecurity.io/about
  • https://cdsecurity.io/blog/how-to-actually-prepare-web3-project-for-security-audits
  • https://github.com/CDSecurity/audits
  • https://raw.githubusercontent.com/CDSecurity/audits/main/README.md
  • https://github.com/CDSecurity/cdsecurity-skills/tree/main/audit-prep
  • https://raw.githubusercontent.com/CDSecurity/cdsecurity-skills/main/audit-prep/README.md

Internal linkages

• Project-layer alias: cd-security.
• Useful adjacent company/operator reads: oak-security, x3-security, and pashov-audit-group.
• Useful contrast for a much broader research-and-tooling shell: trail-of-bits.

Protocol / company boundary

• There is no especially useful standalone CD Security protocol doing the analytical work here.
• The meaningful surface is a company-run review, publication, and readiness-workflow shell: staffing policy, audit scoping, public report release, pre-audit baseline guidance, and the audit-prep automation layer.
• That is why CD Security belongs in companies/: the control question is who authors and packages the practical assurance workflow, not whether one audit archive or skill can be treated as a neutral protocol primitive.

Control surface

• Practical leverage sits in who gets staffed onto reviews, how findings are validated and written up, which audits become public trust evidence, what pre-audit checklist norms get pushed into the ecosystem, and whether teams start using audit-prep as part of their own internal release gate.

• CD Security does not directly control the protocols it audits, but its operator decisions can still shape what customers and outside readers treat as credible security evidence and what baseline hygiene gets normalized before audits begin.

• Read CD Security as a boutique audit-publication and audit-readiness workflow company first, not as a protocol.

• Last reviewed: 2026-08-09 UTC