Check for errors
Checking your errors is essential to avoid subtle bugs and security issues.
Orijtech Security
Supply chain security
Orijtech Security has a mandate of wholly securing software infrastructure. Instead of always working to defend and catch issues, we build secure components from the ground up. Many of the ideas in US Executive Order 14028 are what we had already planned for.
Featured guide
Go Coding Guide for Cosmos
An authoritative reference for code reviews and style for Go code in the Cosmos ecosystem, to reduce vulnerabilities, ease readability, improve robustness and make bugs easier to find.
Read the guide Cosmos Hardening Guide
Qualify every use of unsafe
Every use of package unsafe or its wrappers is an opportunity for security issues to sneak in. Use it only as a last resort.
Do not roll your own crypto
The smallest subtle flaw in a custom algorithm can make a whole protocol insecure. The Go standard library and x/crypto are battle tested.
Use static analyzers early
Integrate analyzers such as go vet, staticcheck, staticmajor and consensuswarn into your editor and CI so you do not forget to run them.
Reports and advisories
What we have published
- Cosmos Hardening Guide ↗Guide
- Go Coding Guide ↗Guide
- Cosmos December 2023 reportReport
- Software Supply Chain Audit v1 ↗Audit
- ics23 Go v1 audit ↗Audit
- American Express Earlybird audit ↗Audit
- celestia/torch v1 auditAudit
- celestia/nmt v1 auditAudit
- cosmos/gaia Q4 2022 pre-Rho auditAudit
- Tendermint P2P v1 audit ↗Audit
- Advisory: varint decoding ↗Advisory
- Advisory: Go XSS from string concatenation and text/templateAdvisory
- dydx NPM compromise advisoryAdvisory
- Taurus HQ: Go testing and finesseReport
- Time dilation in Go1.11 and Go1.12Report
- PowerOf2 loop meets integer overflowReport
- UNIX file permissions zombieReport