onym audit · order an audit
Orders under signed offers · Onym audit seat · onym:audit-profile:static-ed25519-v1

Any auditor, any component

Order an audit

Choose an auditor and one of their signed offers, point at exact bytes, and sign the order in your browser. The price and the disclosure terms are fixed before anyone looks — nothing you pay can change the result.

  1. You pick an auditor and an offer and fill in the form. Your browser creates an Ed25519 key and signs the order with it — as the component’s owner and as the paying party.
  2. The order waits in that auditor’s queue. Before accepting it, the auditor checks it against their independence policy.
  3. The auditor examines exactly the bytes the order pins and sends you the findings first.
  4. A signed attestation is published. With your key you can post a signed reply beside it, and nobody can edit that reply.
Auditor
—
Fee
—
Report due
—
Findings
—
Embargo
—
Publication
—
What you cannot buy
a result class, silence, or a delay
Auditor

Loading auditors…

Every auditor signs their own manifest and offers; this page checks each signature before showing an offer.

What to examine

Public repositories only: the examination reads public bytes.

The full 40-character id. The attestation will cover these exact bytes and nothing else: git rev-parse HEAD

The released file. The hub hashes it now; the order binds that digest to the repository and commit below.

The component’s signed manifest. The order binds the exact bytes served right now.

How your component is named in the Onym network — the attestation’s subject.

Scope

Name files, directories or concerns. The scope is published with the attestation; what is outside it is listed as not examined.

You

How the auditor can reach you about this order: an email, Telegram, anything. Stored with the queued order, never published, deleted 90 days after a decision.

Your signing key. It proves the order is yours, and later lets you sign a reply to the attestation.

Only the signed order, the scope text and your contact, if you gave one, are sent. The key stays in your browser.