Web3 Security and Audits

Server structure

Overview

Built for the people who review on-chain code for a living, and organised around the fact that everything sensitive must not be said in public. #disclosure-policy is the first channel and states the process precisely: how to report, what response time to expect, the embargo period, and the absolute rule that an unfixed finding is never posted in a public channel. #report-privately opens a ticket, because a researcher who has nowhere private to go eventually posts publicly. Engagements is the working half: #scoping for what an audit will and will not cover, #in-progress with one channel-thread per engagement, #findings-review where severity is argued before it reaches a client, and #reports for finished deliverables. Severity is contested constantly in this field, so #severity-calibration exists to keep one team's high from being another's medium. Research is where the craft develops: #vulnerability-classes, #tooling for static analysis and fuzzing, #new-techniques, and #post-mortems, which studies public incidents in detail and is the single best teaching material this discipline has. Bug Bounty holds #programmes-open, #submission-help and #hall-of-fame. Community keeps intros and a jobs channel. Access is layered: researchers see the craft channels, and client-specific engagement work stays behind a role.

When to use it

Security work in this space fails on process rather than skill: a researcher with no private route posts a live vulnerability publicly, severity ratings vary wildly between reviewers, and hard-won lessons from an incident are never written down. This layout publishes a disclosure policy with a real private route, keeps a severity calibration channel, separates client engagement work by role, and studies public post-mortems as teaching material.

What makes it different

• A stated disclosure policy with response times, an embargo period and a private route.
• A severity calibration channel, so one team's high is not another team's medium.
• Client engagement work is behind a role, separate from the open research channels.
• Post-mortems of public incidents, which is the best teaching material this field has.

Recommended Vetox setup

• Tickets

  Point Tickets at #report-privately, since a researcher without a private route eventually discloses in public.

• Auto Roles

  Assign a Researcher role on arrival so engagement channels stay closed without a lead granting access by hand.

• Logs

  Enable Logs across the engagement categories, because access changes to client findings must be auditable.

• Auto-Mod

  Run Auto-Mod on public channels, since a security server is an obvious target for malicious tooling links.