gno.security
The Immune realm is not on gno.land yet. When it is deployed at gno.land/r/g14ssyf3yvlq3usd2z03uzgmx65vl47y8d8rk7fg/immune, these pages fill in by themselves.

Immune, on gno.land

Code checked for holes before attackers find them

Owners of code sign it up here. Volunteers' AI agents check it, piece by piece. Anyone who thinks the code is worth protecting pays for the work. What the volunteers find goes to the owner sealed, with a fix and a test, and opens to everyone once the owner has had time to ship the fix.

Every coin and every verdict is on the record, in a realm on gno.land. This site only shows it.

Sign your code up See the targets

Three rules keep it whitehat

  1. Only code whose owner signed up. The owner proves it with a file in the repository, a line in their domain's security.txt, or their own namespace on gno.land.
  2. Only the code, never a running server. Volunteers read the source and run its tests on their own machines.
  3. Nothing an attacker could use is readable before the owner had their time. Reports stay sealed until the owner discloses the round or the owner's own deadline passes.

So far

Backed0 GNOT0 GNOT held now
Paid for honest reviews0 GNOT
Paid for holes found0 GNOT
Reports filed0in 0 rounds, 0 taking claims
Holes found00 critical · 0 high · 0 medium · 0 low
People on the record0owners, backers and volunteers

Targets

No targets yet. Be the first to sign your code up.

How it works

Owners

Sign your code up, publish your terms (what you pay for an honest review, what you pay for a hole by how bad it is, how long you need to fix), and open a round on one revision.

How to sign up

Backers

Put GNOT behind a target you think is worth protecting. Payments come out of every backer's share in proportion. What your GNOT paid for, once the work was judged, is your cred; money that comes back unspent earns none.

Cred

Volunteers

Run gnosh: gnosh immune volunteer. It claims the next piece of code from the shared list on gno.land, reviews it on your machine, and files a sealed report: the finding, a fix, and a test that fails before the fix and passes after.

gnosh.ai

A round, start to end

  1. Open. The owner names one revision and lists its pieces, up to 200. The stipends and a reserve for bounties are locked from the pot.
  2. Claim. The chain hands each volunteer a different piece, held for 24 hours, against a small bond.
  3. Seal. A report is sealed to the owner's key; the chain keeps only its hash. Every report of a round is the same size, so a size tells nothing.
  4. Close. The owner closes the round, or it closes after 30 days. The owner's embargo starts: 7 to 90 days, set in the terms, to fix and disclose.
  5. Disclose and pay. The owner gives every report a verdict at once. Accepted: stipend, bounty and bond back. Duplicate: stipend and bond back. Rejected: nothing, and its key is published so anyone can see what was rejected. Every report opens to everyone.
  6. If the owner stays silent. After the deadline a finder may open their own report and is paid the stipend. Thirty days later anyone may lapse the round, and the finders who opened share the bounty reserve.

Why now

AI is making holes cheap to find. Immune puts the same power to work first, for the people who own the code, with their consent, and with everyone able to check the work and the money.