The open database of Web3 audit findings.
180,907 findings from 13,040 public smart-contract audits by 65 firms and contest platforms, 2015 to 2026. Search them here, download every file, or point your AI agent at them for your next audit.
No API key. No sign-up. It's all files.
What's in a record
Real findings, as the database stores them
Jump to a project
- 65audit firms and contest platforms
- 13,040audits, 12,264 with an exact date
- 13,979report files, each linked to the original
- 11,262audited projects
- 180,907finding records
- 165,451with full finding text
Audit years 2015 to 2026. 2026 is year to date: the snapshot was taken on 2026-10-22.
Download everything
No API key, no sign-up, no rate limit. The whole database is a set of plain files on GitHub. Take what you need.
- audits-markdown.zip118 MB
One Markdown file per report, every finding a section. Unzip it and point Claude Code, Codex or Cursor at the folder.
- findings.parquet75.4 MB
The findings table for DuckDB, pandas or Polars. Join it to engagements.csv and reports.csv.
- findings.jsonl.gz106 MB
One JSON object per finding, with firm, project, year and the original report link. For scripts and jq.
- findings.csv.gz93.8 MB
The same table as compressed CSV, for spreadsheets and anything else.
One file
curl -LO https://github.com/DicksonWu654/web3-audit-corpus/releases/latest/download/audits-markdown.zipEvery file, with the GitHub CLI
gh release download --repo DicksonWu654/web3-audit-corpusAudits, report links with SHA-256 hashes, the taxonomy and every quality measurement are on the data page. Working with an agent? Start with the agent guide.
By the numbers
Use the data
Search every finding
Filter by firm, date, severity, fix status, vulnerability class and review type. Every finding has its own page to read and share.
Search findingsBrowse by firm
Every firm and contest platform has a page with its audits, finding counts and a link to each report.
Browse firmsHand it to your agent
Unzip one Markdown file per audit and let your coding agent search past findings while it reviews your code.
Use with AI agentsCheck how it was built
Collection, measured accuracy, the vulnerability taxonomy, coverage per firm, rights and corrections.
Data and methods