# Security audits and reviews **AERE Network has had no third-party security audit.** That is the first line of this page on purpose, and it stays here until it is no longer true. Everything below describes what we have verified ourselves, which is a weaker thing, and we do not want the difference blurred. Last updated: 2026-09-01. --- ## External audits | scope | auditor | date | report | |---|---|---|---| | — | none | — | — | There is nothing to put in this table yet. When there is, the full report goes here, including any findings we chose not to fix and why. ## What we have done instead, and what it is worth - **Continuous self-verification.** The chain's live properties are re-measured automatically rather than asserted in prose: validator set size, quorum, the post-quantum anchor threshold, the base-fee floor, backup coverage, and the public verifier. A claim that stops being true shows up as a failed check, not as stale documentation. This is real, and it is still *us checking us*. - **Negative controls on every gate.** A check that has never been shown to fail is not evidence. For each safety-relevant check we plant the defect it is supposed to catch and require it to go red, then restore the source and require it to go green. A check that cannot fail is treated as broken. - **A reproducibility package prepared for an external reviewer.** The consensus code under review, a threat model naming the attack surfaces we consider realistic, a pinned reproduce guide, and a manifest of file hashes. It is ready to hand over. - **Independent verification by a second implementation.** The post-quantum anchor certificates on the live chain are validated by a second client, written in a different language on a different codebase, which reaches its own verdict on every anchor. **None of that is an audit.** Self-verification finds the mistakes you thought to look for. ## Verify the chain yourself, without trusting us The post-quantum anchor is designed so you do not have to take our word for it: from block 13,014,000 every 32nd block, and from block 17,225,968 every 128th, carries a post-quantum certificate (Falcon-512, and from block 17,047,600 also SLH-DSA-SHA2-128s), and the block hash covers it. From block 14,961,456 that certificate requires at least six valid seals of each scheme (six of nine validators then, six of ten since 2026-09-11). The verifier is public, the signatures are in the headers, and the check runs against any node — ours or your own. ## Reporting a vulnerability Report to **security@aere.network**, or see for the full policy. - We aim to acknowledge within 72 hours. - Public credit on this page unless you ask to remain anonymous. - We will not pursue legal action against good-faith research conducted under the published policy. - If a report leads to a fix, the fix and the finding are published here together, including the window during which the issue was live. ## What this page will never do It will not describe a self-review as an audit, and it will not report a fix as complete before it has been verified on the live chain. If you find a claim on this page that you can measure and disprove, that itself is a valid security report, and we would like to receive it.