Audit reports
This page lists the security reviews of the Cartesi Rollups stack, whether they were carried out by the Cartesi QA team or by an external audit firm. Each report is a PDF with the reviewed versions and the findings that were reported to the maintainers, with the description and impact of each one.
Reviews by the Cartesi QA team are internal reviews. They are not audits by an external firm.
| Date | Report | Reviewed by | Components | Download |
|---|---|---|---|---|
| August 4, 2026 | Rollups Node v2.0.0-alpha.12 security review | Internal QA team | rollups-node v2.0.0-alpha.12, rollups-contracts v3.0.0-alpha.6, CLI alpha.34 and alpha.35 |
Reporting a vulnerability
Do not open a public issue, pull request or discussion for a security problem. Report it privately by email to rollups@cartesi.foundation.
Please include:
- The affected component and version (release tag or commit).
- The impact and who is affected.
- Steps to reproduce, ideally a script or a test.
Reports sent by email are not encrypted. If your report contains sensitive material, mention it in your first message.
What happens next
We review each report, decide how to handle it, and reply with the outcome. When a fix is released and the issue affects users, we may describe it on this page. Please give us a reasonable time to fix an issue before you disclose it publicly.