Research & methods

How the tools and the report system actually work.

Technical notes written from the code that ships: what each method reads, what it infers, what it refuses to do, and why. 6 notes so far.

This is not a vulnerability-disclosure feed and publishes no CVEs. Suspected vulnerabilities in the Solvex platform itself go to the disclosure route.

Web and API posture

Technical note · 1 min read
Reading a CVSS vector for the shape that gets exploited at scale
A base score is one number. The vector behind it says whether an issue is reachable over the network, needs no privilege and no user interaction — the combination that gets exploited at scale. The CVE lookup reads the vector.
Read the note

Domains, email and exposure

Technical note · 2 min read
Your certificates already published your subdomain inventory
Every TLS certificate you are issued is written to a public, append-only log. An attacker's first move is to read it. The Attack Surface Mapper reads the same log and triages it — without scanning a port or guessing a name.
Read the note

Contracts and wallets

Report verification

Technical note · 2 min read
How a Solvex report is signed, and how anyone can check it
Every issued report carries an Ed25519 signature over both its content and its file. Verification is public, needs no account, and reveals nothing about what the report says.
Read the note

Evidence and provenance

Technical note · 2 min read
Evidence that cannot change after the report is issued
A finding is only as good as what backs it. Solvex stores evidence encrypted, anchors it by digest, and freezes it in the same database transaction that issues the report.
Read the note

The standard these notes are held to

Every method described is implemented in the shipped tools or the report system; the note links to the tool or page that runs it.
Each note states what is read, what is inferred, and what is refused — the same three-part honesty every tool result carries.
Nothing is published that the repository cannot substantiate: no third-party disclosures, no CVEs, no customer material.
Dates are the dates the notes were written. Corrections replace the note; they are not hidden.

How the tools and the report system actually work.

Web and API posture

Reading a CVSS vector for the shape that gets exploited at scale

Domains, email and exposure

Your certificates already published your subdomain inventory

Contracts and wallets

Address poisoning: the transfer you did not ask for

What a contract's bytecode can and cannot tell you

Report verification

How a Solvex report is signed, and how anyone can check it

Evidence and provenance

Evidence that cannot change after the report is issued

The standard these notes are held to