Skip to main content

Security Audit Report

Date: February 2026 Scope: Full codebase (15 Rust crates, 624 dependencies) + VexAI Python service Status: Pre-beta internal audit. External professional audit planned post-funding.

Summary​

We ran 9 industry-standard security analysis tools against the entire Vexidus codebase. The results confirm zero critical or high-severity vulnerabilities in our application code.

ToolPurposeCriticalHighMediumLow
cargo-auditDependency CVE scan0000
cargo-denyLicense & policy0000
cargo-geigerUnsafe code detection0000
gitleaksSecret scanning (full git history)0000
semgrepStatic analysis (SAST)0000
clippy (pedantic)Rust linting (max strictness)0000
banditPython SAST0000
pip-auditPython dependency CVE scan0000
Dependency pruningAttack surface reduction————

All identified dependency CVEs have been patched. All unused dependencies have been removed.

Key Findings​

Zero Unsafe Rust​

Vexidus is written entirely in safe Rust. All 15 application crates contain zero unsafe blocks. The only unsafe code in the build is within well-audited, widely-used infrastructure dependencies (tokio, rocksdb, ring/rustls, libp2p).

Tool: cargo-geiger — scans the entire dependency tree for unsafe code surface area.

Zero SAST Findings in Production Code​

Static analysis with semgrep (Rust and security-audit rulesets) found zero vulnerabilities across all production Rust code. Two low-severity findings were flagged in test utility scripts (not production) — a dynamic URL in a load tester and an HTTP request in a localhost test tool.

Zero Secret Leaks​

gitleaks scanned the entire git history and found no leaked credentials, API keys, SSH keys, or private keys. Nine detections were all confirmed false positives (well-known public token contract addresses and deterministic testnet keypairs with no real-world value).

All Dependency CVEs Patched​

  • Rust: cargo-audit checked 624 crate dependencies against the RustSec Advisory Database. One high-severity CVE was found (bytes integer overflow) and immediately patched. Remaining advisories are informational (unmaintained upstream crates with no impact on our usage).
  • Python: pip-audit found 10 CVEs across 6 Python packages. All were upgraded to patched versions on the same day. Re-scan confirmed zero remaining vulnerabilities.

Dependency Pruning​

We analyzed every dependency declaration against actual usage in source code and removed 8 unused dependencies to reduce attack surface. Staged dependencies for planned features (ZK-STARK verification, hybrid key exchange) were intentionally retained.

Post-Quantum Ready​

Vexidus includes Dilithium3 (NIST post-quantum standard) alongside Ed25519 for signature verification. Accounts can hold both key types, and key rotation is built in — positioning Vexidus ahead of the quantum migration timeline.

Production Hardening​

Vexidus includes configurable security flags that allow the same binary to run in testnet mode (relaxed for development) or production mode (strict verification). All security-sensitive behaviors have corresponding CLI flags documented in the Validator Setup Guide.

Tooling​

All security tools remain installed on our infrastructure for ongoing monitoring:

ToolVersionPurpose
cargo-audit0.22.1Rust dependency CVE scanning
cargo-deny0.19.0License policy enforcement
cargo-geiger0.13.0Unsafe code surface detection
gitleaks8.21.2Git history secret scanning
semgrep1.152.0Static application security testing
clippyrustupRust linting (pedantic + nursery)
bandit1.9.3Python SAST
pip-audit2.9.0Python dependency CVE scanning

Ongoing Security Practices​

Current​

  • Automated dependency scanning before every release
  • Output filtering and guardrails on all public-facing AI services
  • Rate limiting on all API endpoints
  • Ed25519 signature verification on all transaction bundles
  • Configurable security modes via CLI flags

Planned​

  • CI/CD Integration: Automated cargo audit + semgrep on every push
  • Fuzz Testing: cargo-fuzz targets for critical execution paths
  • External Audit: Professional audit by a top-tier blockchain security firm (Trail of Bits, Zellic, OtterSec, or Halborn)
  • Bug Bounty Program: Public bounty program via Immunefi or HackerOne
  • Formal Verification: Consensus finality and bridge logic

Test Suite​

The Vexidus codebase maintains a comprehensive test suite:

  • 204 tests across all 15 crates
  • All tests passing with zero failures
  • cargo check clean compilation
  • Tests cover: state machine operations, token standards, staking, governance, multi-sig, bridge logic, signature verification, address derivation, hash formats, and more

Responsible Disclosure​

If you discover a security vulnerability in Vexidus, please report it responsibly:

We take all reports seriously and will respond within 48 hours. Please do not disclose vulnerabilities publicly until we've had time to investigate and patch.