Pashov Audit Group

• Name: Pashov Audit Group
• URL: https://www.pashov.com/
• Category: security review company / GitHub-native audit-publication operator / AI-audit-skills and tooling-curation company
• Tags: ethereum-ecosystem
• Summary: Pashov Audit Group belongs in companies/, not projects/, because the useful question is not what audit PDF exists? but which named operator curates a public audit corpus, packages AI-powered security workflow, and turns GitHub-native publication into reusable assurance infrastructure other teams may start treating as trust evidence? There is no especially useful standalone protocol boundary doing the work here. The real leverage sits in who scopes and publishes reviews, which findings and report styles become legible defaults, and how much of a team’s pre-audit or release workflow hardens around Pashov-authored skills and tooling maps.
• What it does:
  • Performs smart-contract security audits under the Pashov Audit Group brand
  • Maintains a large public pashov/audits repository that functions as a first-party archive of security reviews across lending, DEX, stablecoin, yield, RWA, and other protocol categories
  • Ships pashov/skills, a first-party set of AI-powered Solidity security skills including x-ray, solidity-auditor, and fizz
  • Maintains pashov/ai-web3-security, a broader curated tooling map spanning free/open-source and paid/closed-source AI security tools across Solidity, Rust/Solana, Move/Sui, and multi-language workflows
  • Uses its public repositories as part of the operating trust surface rather than hiding all methodology and output behind a sales or client portal
• Key claims:
  • The official site currently leads with Elite Security. Zero Compromise. Max Speed., which is a simple but useful signal that the company wants to be read as a security operating brand rather than a neutral protocol primitive
  • The pashov/audits README explicitly brands the repository as Pashov Audit Group Smart Contract Security Audits and invites projects to reach out for a security audit, which makes the report archive itself part of the company boundary
  • The public audits README also surfaces repeated coverage across high-signal protocols and categories including Aave, Uniswap, Ethena, Euler Earn, and others, showing that the archive is not a token sample page but a meaningful trust-signaling surface
  • The pashov/skills README says it provides AI-powered Solidity security skills — built by Pashov Audit Group and exposes named workflow modules for pre-audit scanning, multi-pass auditing, and fuzz-suite generation
  • The same skills README includes install / run prompts for Claude Code, Codex, Cursor, GitHub Copilot, and Windsurf, which is analytically useful because the company is packaging its review habits into portable agent workflow rather than only selling manual audits
  • The ai-web3-security README calls itself A curated list of AI tools for smart-contract security. Built and maintained by pashov.com, which means the company is also curating a broader ecosystem tooling map that can shape what other reviewers and teams treat as the practical security baseline
• Whitepaper: No classic standalone company whitepaper is the point here. The clearest current primary materials are the homepage plus the first-party audits, skills, and ai-web3-security repositories captured in ../whitepapers/pashov-audit-group-primary-sources-2026-08-08.md.
• Sources:
  • https://www.pashov.com/
  • https://github.com/pashov/audits
  • https://raw.githubusercontent.com/pashov/audits/master/README.md
  • https://github.com/pashov/skills
  • https://raw.githubusercontent.com/pashov/skills/master/README.md
  • https://github.com/pashov/ai-web3-security
  • https://raw.githubusercontent.com/pashov/ai-web3-security/master/README.md

Internal linkages

• Project-layer alias: pashov-audit-group.
• Useful adjacent company reads: trail-of-bits, ottersec, oak-security, and x3-security.
• Useful contrast where the nonprofit coordination and framework operator matters more than the named assessor: security-alliance-seal.

Protocol / company boundary

• There is no especially useful standalone Pashov Audit Group protocol doing the analytical work here.
• The meaningful surface is a company-run mix of audit scoping, report publication, AI-security-skill packaging, and tooling-map curation.
• That is why this note belongs in companies/: the useful question is who authors and publishes the reusable assurance workflow, not whether one report repository can be treated as a neutral protocol primitive.

Control surface

• Practical leverage sits in which reports get published, how findings and severities are framed, which protocol categories and exemplar audits become most visible, and what outside teams start treating as credible security evidence.

• A second control surface sits in the Pashov-authored skills and tooling maps: once a team adopts x-ray, solidity-auditor, fizz, or the curated AI-tool landscape as part of pre-audit or review workflow, the company starts shaping the practical security baseline before a human auditor even reads the code.

• Read Pashov Audit Group as a GitHub-native audit-publication and AI-security-workflow company first, not as a protocol.

• Last reviewed: 2026-08-08 UTC