Q token mark QUADPublic Accountability

Security and audits

Security

Public labels for audit status, high-sensitivity surfaces, disclosure readiness, and the limits of what can be responsibly claimed today.

Security Snapshot

No stronger safety claim appears until public evidence exists.

External auditNot yet published
Internal reviewNot publicly reported
Bug bountyNot announced
Core custodyHigh-sensitivity surface
Bridge passageHigh-sensitivity surface
Infra proof workReceipt and work-proof surface
Disclosure pathPublic path not yet announced

Security Reader Path

Start with observable public facts, then move toward higher-sensitivity surfaces.

1. Observe CoreCheck chain state, blocks, validators, and metadata. 2. Read CoreReview custody, supply posture, refusal, quarantine, and token-model boundaries. 3. Read BridgeReview passage, inventory, vault labels, gates, host evidence, and lane-gated status. 4. Verify InfraCheck receipt verification and proof surfaces without private payloads. 5. Verify ClaimsUse evidence labels before treating a statement as live, staged, blocked, or closed. 6. Read RisksCheck which assumptions are open, reduced, blocked, monitored, or closed. 7. Watch UpdatesUse dated notes when audit, disclosure, or security posture changes.

What This Page Can Say

  • Audit status: whether a public report exists.
  • Risk label: which surfaces deserve extra caution.
  • Disclosure readiness: whether a public reporting path is announced.
  • Evidence rule: no published report, no report link.

What This Page Withholds

  • Private access details.
  • Validator keys or sensitive node information.
  • Operator procedure.
  • Private mitigation detail before review.

Report Slots

Future reports can be listed here only when they are real and approved for public release.

SurfaceStatusPublic report
Core custodyNot yet publishedNo report link yet.
BridgeNot yet publishedNo report link yet.
InfraNot yet publishedNo report link yet.
Disclosure updatesPublic updatesUse dated notes when report state changes.

Accountability Posture

The public site can state responsibility without publishing personal identity claims before they are intentionally approved.

Current posture

Responsibility and governance disclosures should be published before stronger custody, movement, or market claims rely on them.

What is avoided

No invented team page, unnamed audit claim, or biography appears as a trust substitute.

What comes first

Status, security labels, audit reports when real, and clear responsibility statements where approved.

Support Disclosure

Funding, hosting, custody, and operational responsibility claims stay narrow until they are approved for public release.

Foundation supportNot publicly disclosed
Hosting supportNot publicly disclosed
Custody responsibilityBefore stronger custody claims
Public ruleNo implied backer without approval