Aunova Reproducible Evidence and Disclosure

Cowork:Alice RED

A public log of the open source security audits we run, including the ones that found nothing.

What this is

RED stands for Reproducible Evidence and Disclosure. It is a promise about the run and about the route it takes. It is not a badge and it is not a certification.

Reproducible
Every entry names the exact commit that was read and the run that produced the candidates, so the same run can be repeated by someone who does not trust us.
Evidence
Every entry links to the artefact behind it. Severity is our own assessment, never a tool's, and we say per entry what was checked by hand and what was not.
Disclosure
Findings go to the maintainer before they go anywhere else. Nothing that is still unpatched is published here.

Runs that turned up nothing are listed alongside the rest. A log that shows only wins is a brochure, not a record.

Timeline

Oldest on the left. Scroll the rail sideways, or give an entry focus and use the left and right arrow keys. Open an entry to read the detail.

The record is short, and stating that is the point. Three engagements against code we do not own have been run to date, and two of them are below. The third went privately to a maintainer whose project carries no open source licence, and it will not be listed at all. Read the outcome field on each entry rather than the count: one is fixed upstream and anybody can check that from outside, one is disclosed and its re-verification by us was not run, an owner decision the entry states plainly. A red team that publishes only what flatters it is not worth reading.

Oldest Time runs left to right Newest
  1. 2026-08-13 disclosed FIPS Nine findings in a Rust mesh network, disclosed privately before anything was said in public
    Target
    https://github.com/jmcorgan/fips
    What we found
    An agentic SAST pass over the project at a pinned commit produced 54 raw candidates. We adjudicated every one by reading the source ourselves and reported 9, of which 7 held up under that review. They sat in three areas: a node's sessions being taken down by a party that could merely reach it, traffic being attributed to the wrong node, and a node's path MTU being steered. We also downgraded the tool's own CRITICAL rating ourselves, because its preconditions required a position on the network the rating did not assume. Severities on this page are ours, never a scanner's.
    Patch status
    Reported privately to the maintainer, who replied within a week and shipped fixes across v0.4.2 and v0.5.0, and who has since stated that the security review cycle behind those releases is closed. Two things we still will not say: we did not re-read the fixed code against our own 9 findings, so calling them verified would be our word rather than a measurement, and the release notes credit unsolicited reviews without naming anyone, so we do not claim those commits as ours. The disclosure route is what this entry evidences: the maintainer had the findings, and had shipped, before any of it was described in public.
    Evidence
    Write-up
    Read the write-up
  2. 2026-08-30 merged floci KMS mints a NIST P-521 key and reports it as Ed25519
    Target
    https://github.com/floci-io/floci
    What we found
    CreateKey with KeySpec ECC_NIST_EDWARDS25519 returned HTTP 200 and a NIST P-521 keypair while still reporting the key as Ed25519, so a caller received the wrong algorithm with no error. Signing then failed as a retryable HTTP 500 rather than a client error, which made the AWS SDK retry an operation that could never succeed. Root cause was a four character copy-paste in the KeySpec enum. Found by manual source review at a pinned commit, no scanner involved, and reproduced against the shipped container image before it was reported.
    Patch status
    Fixed upstream. Pull request 3004, authored by a project contributor, was merged into main on 4 September 2026 and closed the issue. Verified by reading the merged pull request, not on our own say-so.
    Evidence
    Write-up
    Read the report

Availability

This work is done in the open.

Enquiries about it go to c@mailstr.app.