CD Security company primary-source snapshot
Fetched: 2026-08-09 UTC
1) Homepage / company framing
Source: https://cdsecurity.io/
Selected excerpt from the official site:
We stop multi-million dollar breaches by uncovering vulnerabilities in protocol code before the attackers do.
Additional signals from the same page:
- The homepage is clearly a named audit operator page rather than a protocol or neutral standard surface
- The live site foregrounds
audits completedandsecured on chainmetrics, plus supported audit languages, which reinforces that the useful taxonomy question is about a security firm boundary - Client testimonials and service framing are part of the public trust shell rather than something hidden behind a private sales process
2) About page / staffing and working-model boundary
Source: https://cdsecurity.io/about
Selected excerpts from the official site:
CD Security was founded in 2023 by a team of two independent auditors, Chris and Dimitar.
Not to become the next Certik or Trail of Bits, but to stay small, sharp, and focused.
We don’t work with juniors — every auditor has 100+ public findings.
Additional signals from the same page:
- The about page makes the senior-only staffing model explicit, which is analytically useful because staffing policy is part of the assurance boundary clients inherit
- The process section documents a concrete review workflow: direct communication, private GitHub findings, cross-review, draft report, fix verification, and final report publication
- That is exactly the sort of named operator workflow that belongs under
companies/, not a genericprojectnote
3) Public audits repository / report-publication surface
Source: https://raw.githubusercontent.com/CDSecurity/audits/main/README.md
Selected excerpt from the official repository:
CD Security Audit Portfolio
Additional signals from the same README:
- The repo is a first-party public audit archive rather than a stray PDF dump
- The visible report table spans multiple categories and named protocols, which makes publication choice and report persistence part of the public trust surface
- This is enough to justify the entity split even before looking at the broader website copy
4) audit-prep / packaged readiness workflow
Source: https://raw.githubusercontent.com/CDSecurity/cdsecurity-skills/main/audit-prep/README.md
Selected excerpts from the official repository:
Prepare a Solidity project for a security audit. Runs an 8-phase automated readiness check across your codebase and produces a scored report with actionable findings.
Supports Foundry and Hardhat projects.
Additional signals from the same README:
- The workflow explicitly checks testing, documentation, hygiene, dependencies, best practices, deployment, and project docs
- The skill describes a three-agent architecture for testing, source analysis, and infrastructure/context review, which makes this more than a checklist blog post
- This is strong evidence that CD Security is packaging pre-audit workflow and not only selling one-off audits
5) Public guidance / baseline-setting posture
Source: https://cdsecurity.io/blog/how-to-actually-prepare-web3-project-for-security-audits
Selected high-signal point from the cited article as summarized in the corpus note:
the bare-minimum launch baseline should include one internal audit, two external audits before launch, and new audits after every code change before deployment
Additional signals from the same article:
- The firm is not only publishing reports; it is also trying to normalize what
audit readinessshould mean before deployment - That makes the company note more useful than a project note because the real surface is methodology and workflow guidance, not a product primitive
Notes
- This snapshot was created to support a project→company taxonomy split for
cd-security. - The useful split is between a legacy project alias and the named entity that controls audit scoping, senior-only staffing, public report publication, and packaged pre-audit workflow.