Terms

Last updated: 21 October 2026. These are the summary terms. The binding versions are the engagement authorization and the proforma, signed for each engagement.

Service

A fixed-scope, static dependency and risk audit of an Electron or JavaScript application you own or are authorised to examine. Deliverable: a report with an SBOM of exact versions, an Electron posture review (windows, IPC surface, preload bridge, embedded secrets), recomputable evidence IDs, and an explicit section of limitations.

Package	Scope	Turnaround	Price
Entry	Dependencies + risk report	48 h	150 USDT (TRC-20)

Boundaries

• Static analysis only. The submitted artefact is never executed. Runtime behaviour, server-side logic and anything outside the submitted artefact are out of scope.
• No circumvention. DRM, anti-cheat, licence checks and authentication controls are not touched, and engagements that require it are declined.
• You keep the rights to the artefact. The report is yours; the report template and the methodology remain ours.
• Public sample. The engagement published in this repository is an audit of a public, open-source application under its own licence. Your engagement is not published without written permission.

Guarantees

• Deadline. If the report is not delivered within 48 h of the start, 100 % of the fee is refunded — no questions asked.
• Accuracy. If a finding is contradicted by the source, it is re-rendered at no charge or the fee is credited in full. Every finding carries a cryptographic evidence_id: recompute them, and anything that does not reproduce is on us.
• Privacy. The artifact is analysed statically and read-only, on a private runner (ours or yours). It is never executed, never uploaded to a third-party service, and is deleted after delivery unless you ask us to keep it.

Payment

100 % in advance, in USDT or USDC over the TRC-20 or BEP-20 network, before analysis starts. If you do not hold any crypto yet: open an account at a major exchange, verify it, buy 150 USDT with your card, and send it on the network you prefer — ask us which networks we can receive on the day. The clock starts when payment is confirmed on-chain and the artefact and the signed authorisation have been received. One round of clarifications is included for 48 h after delivery.

Contact

Audit with Proof · florito64.1@gmail.com · public sample report.

No warranty

The report is a static-analysis snapshot of the artefact as submitted, with its limitations declared in section 6. It is not a certification and does not claim the absence of defects. Verify the findings before acting on them.