Cowrie Research

cantina-primary-sources-2026-04-28

3 min read

Cantina primary sources — 2026-04-28

Project

  • Name: Cantina
  • URL: https://cantina.xyz/
  • Category: application security platform / smart-contract security marketplace / audit-competition infrastructure / bug-bounty and incident-response control plane
  • Whitepaper status: No canonical Cantina whitepaper or litepaper found in this pass.

Primary sources reviewed

  1. Homepage: https://cantina.xyz/

    • Frames Cantina as an AI-native security platform combining AI with human expertise.
    • Publicly claims 9,000+ researchers, 200+ projects secured, $100B+ secured, and a unified end-to-end security platform.
    • Suggests the company is expanding beyond classic web3 audit competitions into broader application-security positioning.

  2. Docs home: https://docs.cantina.xyz/

    • Describes Cantina as an AI-native security platform for smart contract audits, bug bounties, competitions, penetration testing, and managed detection/response.
    • Explicitly says the platform is powered by the Spearbit network.
    • Clarifies that the platform serves both organizations and security researchers.

  3. Docs index: https://docs.cantina.xyz/llms.txt

    • Provides a machine-readable map of the full docs corpus.
    • Useful evidence that Cantina’s product surface includes researcher onboarding, competitions, bounties, severity standards, judging/escalation processes, referral programs, account setup, and an OpenAPI spec.

  4. About Cantina: https://docs.cantina.xyz/about-cantina/about-cantina.md

    • Explains Cantina’s dual audience: organizations and researchers.
    • States that Cantina’s approach inherits from the Spearbit security network and its methodology.
    • Useful for understanding Cantina as both a marketplace and an operating workflow for security work.

  5. Platform Overview: https://docs.cantina.xyz/about-cantina/platform-overview.md

    • Says Cantina combines modular security solutions, expert researchers, Cantina Code, and reputation systems.
    • Highlights AI-powered tooling plus a purpose-built collaboration layer instead of a single-product scanner.

  6. Competitions docs: https://docs.cantina.xyz/for-organizations/security-solutions/competitions.md

    • Documents the structure of Cantina competitions: scoping, SOW, kickoff, competition period, communication, fix period, findings call, final report, and closeout.
    • Notes mandatory coded PoCs for many high/medium findings from lower-reputation researchers, plus judging and escalation rules.
    • Strong evidence that Cantina is an audit-process control plane, not just a directory of researchers.

  7. Cantina Code docs: https://docs.cantina.xyz/cantina-code/cantina-code-for-companies/cantina-code-for-companies.md

    • Shows the platform includes a dedicated code-review and findings-management environment.
    • Confirms real-time findings visibility and direct researcher-company communication are part of the product.

  8. Public Reports docs: https://docs.cantina.xyz/resources/public-reports.md

    • Points users to Cantina’s portfolio/public-reports surface.
    • Confirms published security reports are a formal part of the platform’s public output.

  9. Portfolio: https://cantina.xyz/portfolio

    • Exposes a large list of public review engagements across major protocols and infrastructure organizations.
    • Helpful for confirming actual breadth of engagements beyond top-level marketing claims.

  10. GitHub organization: https://github.com/cantinaxyz

  • Verified to control the cantina.xyz domain.
  • Public repos are currently oriented in part toward AI-agent security and OpenClaw-related tooling, which is directionally consistent with the homepage’s AI-native security framing.

Takeaways

  • Cantina is best cataloged as security workflow and marketplace infrastructure rather than as a simple audit boutique.
  • The key differentiator is the combination of a researcher network, purpose-built review software, standardized competition/judging flows, and a growing AI-native security narrative.
  • The docs corpus is the real source of truth; it exposes much more of the operating model than the homepage alone.

Graph View