New version of SavantChat is LIVE! 2x more powerful, noticeably faster, cleaner UI. What changed underneath: ▸ In closed test runs, the new engine caught up to 2x more vulnerabilities than the best human auditor working the same code ▸ Stronger models across the pipeline, so audits and answers both got sharper ▸ Context collection rebuilt. The engine actually understands how your codebase fits together now ▸ Vulnerability database workflows optimized and much faster ▸ First-class support for every language you build in (not just contracts) ▸ Fine-tuned prompts doing the heavy lifting underneath ▸ Cleaner UI, dark and light modes This release resets what you should expect from an audit. Go see it. savant.chat

This week we worked on transparency and reliability in the audit pipeline: a permanent activity record for every audit, steadier finding verification, and less waiting around top-ups and imports. ▸ See what your audit did. Every completed audit now keeps a permanent record of which phases ran, how long each took, how many potential issues were checked and dismissed on review, and which verdicts were reached, so a clean report with zero findings still shows the work behind it. The report summary now covers the whole audit. ▸ Faster, more reliable verification. The environment for verifying findings is now prepared in its own step while the audit runs, not after it. ▸ Better support for Foundry projects that reach contracts through project imports and vendored dependency folders. ▸ Crypto top-ups are credited as soon as the payment confirms, not up to 10 minutes later. ▸ Repository imports on the New Audit page no longer leave you on a spinner for up to 30 seconds. ▸ Every file in the scope tree can now show its details, such as why it was excluded, with long details expandable. ▸ Audit progress no longer shows internal error text. TL;DR. Audits now show their work, verification is steadier, and there's less waiting around them.

Glad to be on the @CRX_FX run through @sherlockdefi's Audit Engine. This wasn't a typical Solidity repo: a zkVM risk engine and an FX clearing core, with Rust in scope. SavantChat finished #1 on coverage, unique findings and weighted score: 14 of the 21 accepted findings, 10 of them nobody else surfaced, and a weighted score of 16.

First results from @sherlockdefi's new Audit Engine are public. SavantChat ranks #1 on coverage, unique findings and weighted score. ▸ 66.7% coverage of accepted findings, highest in the engagement ▸ 10 unique findings nobody else surfaced, 47.6% of everything we reported ▸ 16 weighted score, top of the board Ready for the next one.

The line that drained $2M is 1 missing check. SavantChat finds it and writes the exploit that proves it. → savant.chat

This week we worked on the next SavantChat release: faster audits, steadier pipelines, and new models under the hood. ▸ Audits that run start to finish on whatever you send. The goal for the next version: if a project arrives with missing files or half the data incomplete, the agent still carries it from raw upload to a finished report, with no one on our side stepping in. ▸ An agent stack around the product, not just inside it. We are building AI agents that support SavantChat: staying present online, getting current information to users, sales, and the rest. ▸ We are also testing the auditor on bug bounty platforms and sharpening how it performs in that market. Anything you wish the auditor did that it does not do yet?

"A third party gets 1 real finding and 100 pieces of slop. Telling which is which is a really hard problem." — @igorgulamov A question we hear from open-source teams: if an AI audits my code, does the model provider now know my vulnerabilities? Here is what the provider actually sees. An audit produces gigabytes of intermediate reasoning, and most of it is noise by design: hypotheses that went nowhere, checks that failed, paths the critic threw out. The 1 finding that matters is buried in there, and the only thing that can pull it out is the pipeline that produced it. Without that internal state, the raw stream is close to worthless. Meanwhile the code itself is already public. Skipping the audit does not hide the bug from attackers. It only hides it from you.