Every change attacked.
Every fix a pull request.
CoinSec watches your repository and attacks each change as it lands. When it proves an exploit, it opens a pull request with the fix and the exploit it closes.
Runs on every change
Your code changes, and so do its dependencies. The attacker runs again each time, not once a quarter when the audit is booked.
The fix as a pull request
Not a list of problems. A pull request with the change, and the exploit it closes attached, so the reviewer can see exactly what it fixes.
You stay in control
CoinSec never merges. Every fix is a suggestion that a person on your team reviews and merges, or closes.
In the workflow you already use,
from push to merge.
Connect the repository
Connect your GitHub repository once. CoinSec maps the programs in it and starts watching the branches you choose.
Every change is attacked
Each push and pull request is attacked the way an adversary would attack it. When an exploit is proven, your team is alerted where it already looks, and the dashboard shows the state of every program.
Review the pull request
The fix arrives as a pull request with the failing case it closes. Review it like any other change and merge when you're happy.
Repository
Connectedgithub.com/yourteam/vault
watching main, release/*
vault
last attacked 2 min ago
staking
last attacked 2 min ago
Missing signer check on withdraw
Introduced in feat: partial withdrawals. Exploit proven: withdraw without the vault authority's signature.
programs/vault/src/withdraw.rs
Pull request
Ready to reviewRequire the vault authority to sign withdraw
Who Orbit is for
Teams that ship to mainnet more often than they audit.- Protocols whose dependencies change under them between audits.
- Anyone who wants the fix in the pull request, not a finding in a PDF.
Orbit is part of the CoinSec beta, which is opening to Solana teams in batches. Want to see the findings first? Start with a Pulse.