BANKING. WALLETS. THE CODE BETWEEN.
Give payment and wallet changes their own review context. Inspect the source operation, understand what remains unknown, and keep people in charge of the patch.
This candidate adds two separate workspace review modes. The operator must enable the pack before an authorized repository administrator can activate a profile.
Open workspace controls
Conceptual financial review boundaries; no production funds or chain activity.
TWO MODES. ONE CLEAR RECORD.
Declare the currencies and monetary precision your application uses. Native JavaScript/TypeScript checks flag floating monetary conversions and fixed idempotency keys in supported Stripe SDK operations.
These are advisory source observations. They do not prove a double charge, ledger imbalance, authorization bypass or runtime financial loss.
Declare custodial, noncustodial or smart-contract context. Record supported ethers and viem signing, transaction and receipt operations with their reviewed source location. A bounded check flags explicit typed-data chain identifiers outside the declared EVM scope.
A low advisory highlights fixed nonce freshness in exact ERC-2612-style Permit signing inputs. A fixed current nonce can be valid once; this does not prove replay acceptance. Replay protection, custody, receipt success, chain identity and finality remain separate controls.
Inspect supported native Node crypto and HTTPS operations. The pack flags static AEAD IV inputs, visible Math.random contributions to key/IV inputs, and explicit TLS verification bypass.
The inventory records operations and allowlisted algorithms. It excludes key, seed, IV, certificate and transaction values.
SOURCE. POLICY. PEOPLE.
Every specialized report carries the reviewed commit, ruleset, administrator policy version and declaration digest. Per-file coverage shows parsed, partial or unavailable evidence.
The report lists controls that were not assessed. No finding is not a security pass, an accuracy score or a compliance certificate.
Financial patch publication requires two different owners or administrators with current repository access, plus passing isolated validation. Approval binds to the exact patch, reviewed head, destination and policy.
Changing the declaration invalidates an older proposal. Changing mode cannot turn a previously approved general patch into an approved financial patch.
Customer execution stays disabled until the owner qualifies the isolated runner. The new pull request remains the default destination.
Inspect patch approvalTEST THE CHANGE. KEEP THE UNKNOWN.
Explore invented transaction observations: pending, reverted, included, safe or finalized observations, orphaned receipts and removed logs. The same bounded evaluator powers these examples and the offline regression fixtures.
No wallet connection, RPC request, funds transfer or customer source execution occurs. These tests qualify the observation model; they do not attest any customer application or blockchain.
KNOW THE LIMIT.
The native pack does not establish transaction isolation, concurrency safety, reconciliation, account authorization, key custody, replay prevention, chain finality, contract correctness, side-channel resistance or migration safety.
Solidity, Rust and other languages need qualified adapters. SAST, dependency analysis, SBOM/CBOM interoperability, specialist review, held-out accuracy evaluation and private execution need their own verified integrations. This candidate does not claim those integrations ran.
Use synthetic fixtures and public metadata while qualifying a profile. Never submit production keys, seeds, banking account data or real customer funds to a review.
Read processing and security boundaries · Read evidence retention