QVIS·CVSTODIET·IPSOS·CVSTODES
Who watches the watchmen? — Custos does.
Custos is an LLM security auditor for Bitcoin, Lightning, Arkade & L2 codebases. Point it at a directory — or just a repo name — and it reads the security-critical source with a Bitcoin-specific threat model, writing up the bugs that lose funds inside an end-to-end-encrypted enclave. Cleartext never leaves your machine.
npx @tiero/custos run --repo arkade-os/wallet --auto
$ custos run --repo arkade-os/wallet#v0.4.1 --auto custos 0.1.0 — the watchman is awake cloning github.com/arkade-os/wallet.git#v0.4.1 (shallow) enclave prem · glm-5.2 · end-to-end encrypted discover 142 files scanned → 6 crown jewels ranked bundle wallet-seed · signer-rpc · exit-paths audit 3 bundles sealed → enclave (cleartext never leaves) verify 9 proposed → 4 confirmed · 5 refuted CRITICAL seed encrypted with hardcoded default password confirmed CRITICAL LoadSigner RPC reachable without a macaroon confirmed HIGH PBKDF2 at 10,000 iterations for seed-at-rest confirmed MEDIUM non-hardened BIP32 path in nostr derivation confirmed ✓ wrote audit/report.md + audit/findings.sarif (exit 1 · --fail-on high)
Seven ways funds die
General SAST cries wolf at zero-aux BIP340 and MuSig2's commitment rounds. Custos knows the non-bugs — and hunts the classes that actually drain wallets.
Including the Coldcard class: a CSPRNG that runs but doesn't. Seeded from time, PIDs, or nothing at all.
Derivable keys, non-hardened paths, weak KDFs, hardcoded default passwords guarding real seeds.
Nonce reuse, missing commitment rounds, rogue-key aggregation — the mistakes that hand over the private key.
Wrong sighash, attacker-chosen sighash types, unverified taproot tweaks, replayable proofs.
Amount mismatches, double spends, broken forfeit and exit paths, timelocks that don't hold.
Macaroon bypass, wrongly-whitelisted RPCs — admin surface reachable with no credential at all.
Unbounded recursion, parse bombs, hash-table growth — attacker-controlled input doing unbounded work.
The complete taxonomy, with real-world case studies per class in docs/bug-patterns.md.
The method
One command runs the whole rite — or curate the manifest yourself for deeper audits. Findings are model-proposed, then verified; reports separate confirmed bugs from refuted false positives.
custos discover ranks the repo's security-critical files and seeds a manifest — the crown jewels, not the whole codebase. Point it at a path, a git URL, or owner/repo#v1.4.2 to pin the exact tag you shipped; remotes get shallow-cloned for you.
Group files that share a trust boundary, so the model reasons across caller and callee instead of one file at a time.
Each bundle is encrypted in-process and read inside a confidential enclave against the Bitcoin threat model. Your source never travels in cleartext.
Proposed findings are checked; plausible-but-wrong crypto claims get refuted and documented. Out comes report.md plus SARIF 2.1.0 for code scanning.
Confidential by construction
Auditing proprietary wallet code with a cloud LLM usually means mailing your crown jewels to someone else's datacenter. Custos encrypts every request in-process to a Prem confidential enclave — the client runs inside your machine or CI runner.
In CI the enclave client runs inside your runner — the same boundary that already
holds your source. No third party ever sees plaintext. Override
PREM_ENCLAVE_URL to point at your own endpoints.
Not hypothetical
A real run against the arkade-os stack — arkd,
web wallet, and four SDKs — proposed 28 findings. Verification confirmed ten, two of them critical.
LoadSigner sat on the auth whitelist — no macaroon required. Anyone reaching the port
could install their own signer key or URL and control the server side of every MuSig2
signing round: co-sign malicious trees, steal from users, or halt the service.
arkd/…/handlers/signer_manager.go
arkd/…/permissions/permissions.go · auth.go
'noah'The web wallet shipped a hardcoded default password constant and used it to encrypt the
seed when users skipped setting one — a passwordless-by-default wallet, with the key
sitting in localStorage for any XSS to exfiltrate.
wallet/src/lib/constants.ts · privateKey.ts
wallet/src/screens/Init/Init.tsx
The GitHub Action
Custos ships as a composite action — checkout, audit, SARIF, done. But a run is one enclave request per bundle, paced and metered, so the trigger you pick is the cost model. Audit what you ship, not every keystroke.
on: push: tags: ["v*"] permissions: contents: read security-events: write jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: tiero/custos/.github/actions/custos@v0 with: repo-path: . fail-on: critical prem-api-key: ${{ secrets.PREM_API_KEY }}
The audit reads the exact commit you are about to ship, at the one moment the code stops being yours and starts holding other people's money.
fail-on: critical
Fire on the tag push, not on release: published. A published
release can't be un-published by a failing check — by then the audit is a record, not a gate.
on: schedule: - cron: "0 3 * * 1" # Mondays, 03:00 UTC workflow_dispatch: permissions: contents: read security-events: write jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: tiero/custos/.github/actions/custos@v0 with: prem-api-key: ${{ secrets.PREM_API_KEY }} # no fail-on: file alerts, never block
Code that hasn't changed still gets re-read as the threat model and the model itself improve. Last quarter's clean bill is not this quarter's.
Keep workflow_dispatch on it. When a new class of bug lands in
docs/bug-patterns.md, you'll want to re-run the watch by hand that afternoon.
on: pull_request: paths: # only the trust boundaries - "src/crypto/**" - "src/wallet/keys/**" - "src/consensus/**" permissions: contents: read security-events: write jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: tiero/custos/.github/actions/custos@v0 with: target-module: targets/crown-jewels.json fail-on: high prem-api-key: ${{ secrets.PREM_API_KEY }}
A paths: filter plus a curated manifest keeps the read scoped to the
one trust boundary the PR actually touched — the only shape cheap enough
to run while code is still in review.
fail-on: high
Skip this one on a busy repo. Without the paths: filter and a small manifest
it degrades into auditing every push, which is the thing to avoid.
Don't wire it to every push. Each run is a fresh set of enclave requests —
paced 12s apart by default, with an 8000-token budget per bundle — so a
push-triggered audit mostly pays to re-read code that didn't change. Custos is a
ship gate and a standing watch, not a linter.
Findings land as native GitHub security alerts, file- and line-anchored.
The full report.md — confirmed and refuted — attached to every run.
The enclave client runs inside your runner: the boundary that already holds the code.
Where it stands
| DeepSec | Shannon | Custos | |
|---|---|---|---|
| Domain | general app-sec / CWE | black-box API pentest | Bitcoin crypto & fund safety |
| Needs | source | a live target | source only |
| Inference | cloud | cloud | E2E-encrypted enclave |
Same static+LLM shape DeepSec pioneered — the edge is domain depth and confidentiality. Run Shannon black-box and Custos white-box together for full coverage.