CODESPECT

• Name: CODESPECT
• URL: https://codespect.net/
• Category: security-review company / audit-readiness workflow operator / multi-VM public audit-corpus steward
• Summary: CODESPECT belongs in companies/, not projects/, because the useful question is not just what audit PDF or checklist exists? but which named operator packages a SEAL-aligned review method, curates a public audit corpus across multiple virtual-machine ecosystems, and turns pre-audit preparation into a reusable workflow other teams may start treating as part of their security baseline? The practical leverage sits in the company-run review and preparation boundary: who scopes the work, how the methodology is framed, what becomes public trust evidence, and which readiness standards get pushed onto clients before an engagement even starts.
• What it does:
  • Performs smart-contract audits, protocol security reviews, architecture consultancy, and some infrastructure penetration-testing work for blockchain teams
  • Publishes a public first-party audit corpus spanning EVM, Solana, Starknet/Cairo, Move, and other protocol environments rather than keeping all review output inside private client delivery
  • Frames its review method around four explicit phases — static analysis, dynamic analysis, manual review, and formal verification — and ties that method to SEAL-aligned language on the official security page
  • Maintains public audit-preparation guides and checklists for general web3 projects plus chain-specific EVM, Solana, and Starknet preparation
  • Ships an audit-prep readiness skill intended to score Solidity projects before an engagement across tests, docs, dependencies, deployment, and project-context quality
  • Uses public methodology writing and pre-engagement preparation tooling as part of the company trust surface rather than treating them as incidental marketing collateral
• Key claims:
  • The official web3-security page says CODESPECT audits follow a four-phase, SEAL-aligned methodology covering static analysis, dynamic analysis, manual review, and formal verification, which is strong first-party evidence that the firm wants its method to be read as reusable workflow rather than vague expert review
  • The same page says CODESPECT primarily covers EVM, Solana, and Starknet while also advertising support for ecosystems such as Sui, Fuel, and Canton/Daml, which makes the company boundary more useful than any one ecosystem-specific tool note
  • The GitHub organization profile says CODESPECT provides smart-contract audits, secure design and architecture consultancy, and tailored cybersecurity solutions for decentralized applications, reinforcing that the practical dependency is a named operator shell rather than a protocol primitive
  • The public GitHub organization profile also maintains a long finished-reviews table with public and non-public engagements, which makes report-publication choice and corpus curation part of the live trust surface
  • The audit-preparation-guidelines repository says protocols often waste audit budget on auditor orientation and that docs and tests matter as much as code, which is analytically useful because it shows CODESPECT trying to shape the pre-audit baseline, not merely react to finished code
  • The same repository publishes general plus chain-specific preparation guides and a reusable checklist, which means outside teams can inherit CODESPECT’s review assumptions before any auditor is formally engaged
  • The repository’s audit-prep skill is direct evidence that CODESPECT is packaging readiness workflow into portable tooling rather than limiting its influence to manual review hours
• Whitepaper: No classic standalone company whitepaper is the important artifact here. The clearest primary materials are the official web3-security page, the GitHub organization profile, and the public audit-preparation-guidelines repository captured in ../whitepapers/codespect-primary-sources-2026-05-07.md.
• Sources:
  • https://codespect.net/
  • https://www.codespect.net/web3-security
  • https://github.com/CODESPECT-security
  • https://raw.githubusercontent.com/CODESPECT-security/.github/main/profile/README.md
  • https://github.com/CODESPECT-security/audit-preparation-guidelines
  • https://raw.githubusercontent.com/CODESPECT-security/audit-preparation-guidelines/main/README.md
  • https://raw.githubusercontent.com/CODESPECT-security/audit-preparation-guidelines/main/CHECKLIST.md

Internal linkages

• Project-layer alias: codespect.
• Useful adjacent company/operator reads: cd-security, chainsecurity, and coinfabrik.
• Useful contrast where the toolchain rather than the review operator stays primary: certora.

Protocol / company boundary

• There is no especially useful standalone CODESPECT protocol doing the analytical work here.
• The meaningful surface is a company-run mix of review methodology, public report publication, audit-readiness guidance, and portable preparation tooling.
• That is why CODESPECT belongs in companies/: the control question is who authors and packages the practical assurance workflow, not whether one checklist repo or report archive can be treated as a neutral protocol primitive.

Control surface

• Practical leverage sits in how CODESPECT frames the audit method, which reports become public trust evidence, what preparation burden gets pushed onto clients before an engagement starts, and whether outside teams start treating its checklists or audit-prep workflow as default release hygiene.

• The company does not directly control the protocols it reviews, but it can still shape what customers consider audit-ready, what evidence readers treat as credible, and which multi-VM preparation norms spread across teams.

• Read CODESPECT as an audit-methodology, public-report, and audit-readiness workflow company first, not as a protocol.

• Last reviewed: 2026-08-10 UTC