Applied cryptography, on the record.

1. 1.1

   Protocol and implementation review

   Consensus rules, key and note flows, transaction formats, and proof-system integrations, read at the level where the specification meets the code that ships.

2. 1.2

   Security-critical Rust

   Implementation and review in upstream libraries, consensus software, SDK boundaries, and release-critical dependency changes.

3. 1.3

   Wallets and hardware signing

   Transaction construction, PCZT and QR transport, recovery and migration, and device firmware: every boundary a signature crosses on its way to the chain.

4. 1.4

   Authorized adversarial validation

   Reachability analysis, exploitability assessment, and narrow proofs of concept that turn ambiguous risk into reproducible evidence. Performed only under written authorization; see §3.

Engagements usually begin as a design review, an implementation, or an authorized investigation, and end the same way: with a fix that is merged and a regression that holds.

1. 3.1

   Authorization first

   Work begins with an identified system owner, written scope, approved methods, and stop conditions. Authorization is never inferred from public accessibility.

2. 3.2

   Containment by default

   Potentially destructive testing stays in isolated clones, fixtures, simulators, regtest, or dedicated staging unless the owner approves otherwise in writing.

3. 3.3

   Least access

   Least privilege, MFA or passkeys where supported, separated environments, and purpose-limited credentials that end with the engagement.

4. 3.4

   Evidence before claims

   Findings tie to exact code paths and reproducible behavior. Reports distinguish verified behavior from inference and say where uncertainty remains.

5. 3.5

   Private disclosure

   Sensitive findings go to the system owner through an agreed channel and timeline. Public disclosure follows authorization or remediation.

6. 3.6

   Human accountability

   AI-assisted analysis stays under human review. Scope, conclusions, and any proof of concept remain Czar LLC's responsibility.