Security tasks written and reviewed by working researchers, covering exploitation, review, and triage across Web2, Web3, and the software supply chain.
Continuous monitoring for deployed contracts and services, tuned on the same corpus that trains the models.
Pre-deployment review that reads code the way an auditor does, not the way a linter does.
What we learn building the corpus, published in full.
Nine weakly correlated reward signals collapsed into noise. Swapping them for pairwise comparison against a rated reference pool widened the dynamic range and cut training time.
A taxonomy of the 3,000-task corpus by how each item can be checked: exploit executes, detector fires, invariant holds, or human judgment only.
Evaluating current models against disclosed vulnerabilities they could not have memorised, and where the failures cluster.