Cyfrin Audits (@cyfrin) / X

Cyfrin Audits

2,390 posts

Cyfrin Audits

@cyfrin

Securing the blockchain and its users. Powering @cyfrinupdraft | @soloditofficial | @codehawks | @battlechain

Request an audit

Joined January 2023

Pinned
Cyfrin Audits
@cyfrin
Apr 15
Your newest AI security engineer has just arrived. Cygent isn't just an AI bug scanner; it learns your codebase, works alongside your team, and writes the PRs to fix them. - Finds bugs - Gets on calls - Schedules tasks - Proactive security advice All in your chat interface 🧵
00:00
28K
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
Our auditors see dependency issues in nearly every engagement. The teams that catch them early are the ones with workflows that don't punish you for checking. That's what this is built for. Cygent dependency monitoring is live now. Worth setting up before your next dependency
Cygent — Your Dedicated AI Security Engineer
From cygent.dev
152
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
The loop between alert and verification is where teams stall. An alert fires in Slack, someone opens a browser, checks the advisory, cross-references the lockfile, pushes a bump, then has no fast way to confirm it resolved. Cygent closes that loop in the same channel where the
162
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
This matters most for transitive dependencies. The ones your team never directly installed but inherited three layers deep. Cygent checks against your real dependency graph, not a generic feed. If the vulnerable package is still reachable through another path after your fix,
42
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
The response includes everything you need to verify the fix without leaving chat. → Package name and affected versions → Severity level and advisory source → Whether the vulnerability still exists in your dependency tree → Suggested remediation if it does No tab-switching.
534
Cyfrin Audits
@cyfrin
Jun 8
Replying to @cyfrin
The workflow is simple. You push a fix or update a dependency. Instead of switching to a dashboard or CLI, you trigger a re-scan from the same chat channel where the alert originally landed. Cygent runs the scan against your actual project dependencies and reports back right
852
Cyfrin Audits
@cyfrin
Jun 8
We've watched teams lose hours context-switching between vulnerability alerts, package managers, and chat threads trying to confirm a fix actually landed. Cygent now lets you trigger a dependency re-scan directly from Slack, Discord, or Telegram. 🧵
1.2K
Cyfrin Audits
@cyfrin
Jun 7
Replying to @cyfrin
We've audited hundreds of protocols. The teams that get burned by dependency issues aren't the careless ones. They're the ones with no system for catching what they can't see. Cygent collapses that entire workflow into one place so your team can focus on building.
Cygent — Your Dedicated AI Security Engineer
From cygent.dev
198
Cyfrin Audits
@cyfrin
Jun 7
Replying to @cyfrin
Cygent checks OSV, GHSA, Socket, and other intelligence sources in one pass. When severity changes or advisories get updated, it re-evaluates and notifies your team through Slack, Discord, Telegram, or email. You can also trigger a fresh scan directly from chat after pushing a
236
Cyfrin Audits
@cyfrin
Jun 7
Replying to @cyfrin
This is exactly why we built dependency monitoring into Cygent. → Daily scans against your actual dependency graph → Alerts only for vulnerabilities that exist in your codebase, not generic noise → Visual dependency exploration so you can trace a vulnerable package three
35
Cyfrin Audits
@cyfrin
Jun 7
Replying to @cyfrin
The manual workflow is brutal. Cross-reference OSV. Check GitHub Security Advisories. Search Socket. Then trace the dependency tree backward to figure out which direct package even introduced it. Most teams don't do this. Not because they're lazy. Because it takes hours per
234
Cyfrin Audits
@cyfrin
Jun 7
Replying to @cyfrin
Transitive dependencies are the blind spot. A package you chose pulls in another package, which pulls in another. Three layers deep, there's a known CVE. Your team has no idea it's there because they never added it to the manifest.
357
Cyfrin Audits
@cyfrin
Jun 7
Most vulnerabilities we see in audited codebases don't come from code the team wrote. They come from packages the team never directly installed. 🧵
760