Skip to content

docs: add security review preparation checklist#434

Open
sylvarissolutions-max wants to merge 1 commit into
crytic:masterfrom
sylvarissolutions-max:add-security-review-checklist
Open

docs: add security review preparation checklist#434
sylvarissolutions-max wants to merge 1 commit into
crytic:masterfrom
sylvarissolutions-max:add-security-review-checklist

Conversation

@sylvarissolutions-max
Copy link
Copy Markdown

Closes #113.

Converts the Trail of Bits blog post on preparing for a security audit into an actionable checklist, with the blockchain-specific additions mentioned in the issue.

What is in this PR

New file: `development-guidelines/preparing-for-a-review.md`

Organized into five sections:

  1. Define the scope and goals
  2. Resolve the easy issues (compiler warnings, Slither, test coverage, dead code)
  3. Document the codebase (NatSpec, inline comments, prior reviews)
  4. Deliver the code batteries-included (build environment, test process, deployment)
  5. Blockchain-specific preparation (Slither setup, commit hashes, reviewer access, privileged roles, external dependencies)

README update: one new bullet under Development Guidelines, alphabetically placed between Incident Response and Secure Development Workflow.

Style and voice

I tried to match the existing checklists in the repo (`token_integration.md` and `review_checklist.md` were the closest references). Every item is a check-boxed imperative with a one-line rationale. I kept the language consistent with those files and avoided adding commentary that was not already in the Trail of Bits post or in the issue comments.

I incorporated the points raised in the issue thread about blockchain-specific preparation: Slither execution, commit hash pinning, reviewer access provisioning, privileged role documentation, and external dependency trust assumptions.

What is NOT in this PR

  • No changes to existing checklists
  • No changes to the Slither guide or other linked docs
  • No new diagrams or images
  • No CI or tooling changes

Happy to adjust the wording, split sections differently, move the file, or restructure if it fits better with the rest of the repo. Let me know.

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Apr 11, 2026

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

How to prepare for a security review checklist

2 participants