About OpenSourceCheck
A public, git-native registry of LLM-assisted security-review runs of open-source projects, Bitcoin-first. Every entry is a signed, human-validated, reproducible attestation.
What an entry means
A model was run over a stated scope and a human triaged what it reported. It is not a safety certificate — a clean run can miss real bugs, as the 2026 Coldcard seed-entropy hack showed.
How to read an attestation
- target
- the repo and the exact commit that was reviewed (never a branch)
- run
- the exact model, harness, prompt pack, and a hash of the full transcript — so the run can be re-done and compared
- findings
- each with a severity and a human-triage status; raw model output stays unreviewed until a named validator confirms it
- verdict
- findings-validated, clean-run (ran to completion, nothing actionable in scope — a first-class result), or inconclusive
- signature
- a Nostr (schnorr), SSH, or PGP signature over the canonical attestation, verifiable fully offline
Verify any entry yourself
git clone https://github.com/TheIcarusWings/opensourcecheck.git
cd opensourcecheck && npm ci
node tools/osc/osc.mjs verify --all
Verification trusts no server: it checks each signature against the auditor's registered key.
Responsible disclosure
Findings of severity medium or higher in live software are published as withheld-pending-disclosure — only a body_sha256 hash-commitment is shown (proving priority without leaking the bug) until a fix ships. See the disclosure and governance policies in the repository.