Contribute an audit

Signet audits are signed attestations you publish with the signet CLI. Your private key never leaves your machine — the registry only ever sees the signed bundle. Reviewers and downstream tools then reuse your work instead of re-scanning the same code.

  1. 1Build the CLI

    The CLI is Rust; build it from source (a published binary lands with the tagged release). Point it at a registry with --registry or the SIGNET_REGISTRY environment variable.

    $ cargo build --release -p signet-cli
$ alias signet=./target/release/signet

  2. 2Create a signing identity

    Generate an ed25519 keypair and register it under a short profile name. Your identity is the key's fingerprint; reputation accrues to it as your audits are peer-verified.

    $ signet keys generate --out ~/.signet
$ signet keys add me ~/.signet/signet.key   # register it as the profile "me"
$ signet whoami --key me

  3. 3Publish a display name (optional)

    Self-asserted and signed by your own key — no admin approval — so the registry shows a human name instead of a raw fingerprint.

    $ signet profile --display-name "Ada Lovelace" \
    --github https://github.com/ada --key me

  4. 4Attest a repository at a commit

    Run this from the audited git checkout — signet derives the repo, commit, and file hashes for you. Scope the files you actually reviewed and record what you found (vetted-clean or vulnerability-found:CWE-…). Add --submit to publish immediately.

    $ signet attest \
    --scope lib/router/index.js:1-150 \
    --claim vetted-clean:CWE-79,CWE-89 \
    --tool semgrep@1.79.0:p/owasp-top-ten \
    --notes "reviewed router input handling" \
    --key me --submit --registry <registry>

  5. 5Document false positives from your scanners

    Turn a dismissed scanner finding into signed ground truth: import the Semgrep (or SARIF) result and say whyit's a false positive. Consumers then suppress that exact rule on that exact file content by ruleId + hash — the false-positive registry (FR-1), so nobody re-triages the same noise.

    $ signet fp add --from-semgrep semgrep.json \
    --category sanitized-elsewhere \
    --justification "redirect target is checked against an allowlist first" \
    --key me --submit --registry <registry>

  6. 6Strengthen the web of trust

    Peer-verify other auditors' work to raise its confidence (and your own standing), or flag a claim you can falsify. Verifications and flags are staked — bad-faith actions are slashed.

    $ signet verify <attestation-urn> --depth reproduced --key me
$ signet disputes                 # review OSV ground-truth + open flags

Full command reference and the attestation schema live in the design docs. Browse existing auditors to see reputation and coverage in action.