A public registry of AI security audits for open source
After the July 2026 Coldcard hack — ~$89M drained through a five-year-old software-PRNG seed bug in open-source firmware — one fact is inescapable: attackers already run frontier models against public code. OpenSourceCheck is where defenders publish their audit runs in the open: signed, human-validated, and reproducible.
Read this first
An entry means a model was run over a stated scope and a human triaged what it reported. It is not a safety certificate. A clean run can miss real bugs — Coldcard proved exactly that.
Coverage map — 9 projects, 30 attestations, 22 findings
| Project · last audited commit | Highest severity | Models | Lenses | Last checked | Coverage |
|---|---|---|---|---|---|
| github.com/bitcoindevkit/bdk_wallet
@ fc88144fc8 · src/keys/ |
info worst of 4 |
claude-fable-5 grok-4.5 |
entropy-rng tx-authorization | 2026-08-04 | 4 runs 2 findings |
| github.com/Coldcard/firmware
@ bcc2c382a3 · stm32/COLDCARD/ |
critical worst of 4 |
claude-fable-5 grok-4.5 |
entropy-rng tx-authorization | 2026-08-04 | 4 runs 5 findings |
| github.com/diybitcoinhardware/embit
@ fff7ffa43f · src/embit/util/ |
low worst of 4 |
claude-fable-5 grok-4.5 |
entropy-rng tx-authorization | 2026-08-04 | 4 runs 4 findings |
| github.com/KeystoneHQ/keystone3-firmware
@ 31f1fa88a5 · src/managers/keystore.c |
info worst of 2 |
claude-fable-5 | entropy-rng tx-authorization | 2026-08-04 | 2 runs 2 findings |
| github.com/proto-at-block/bitkey
@ cf16705543 · firmware/lib/wallet/src/seed.c |
info worst of 4 |
claude-fable-5 grok-4.5 |
entropy-rng tx-authorization | 2026-08-04 | 4 runs 2 findings |
| github.com/rust-bitcoin/rust-secp256k1
@ 9fc86f756f · src/ecdsa/mod.rs |
info worst of 2 |
claude-fable-5 grok-4.5 |
entropy-rng | 2026-08-04 | 2 runs 1 finding |
| github.com/SeedSigner/seedsigner
@ 1fb2956322 · src/seedsigner/helpers/mnemonic_generation.py |
info worst of 4 |
claude-fable-5 grok-4.5 |
entropy-rng tx-authorization | 2026-08-04 | 4 runs 3 findings |
| github.com/trezor/python-mnemonic
@ b57a5ad77a · src/mnemonic/mnemonic.py |
info worst of 2 |
claude-fable-5 grok-4.5 |
entropy-rng | 2026-08-04 | 2 runs 1 finding |
| github.com/trezor/trezor-firmware
@ 2b1938cc4d · core/embed/sec/rng/ |
info worst of 4 |
claude-fable-5 grok-4.5 |
entropy-rng tx-authorization | 2026-08-04 | 4 runs 2 findings |