05 / Domain
Security
Security is a delivery discipline.
The problem
Most losses come from keys, pipelines and infrastructure, not just contracts.
In Web3, a single leaked key or poisoned dependency can cost more than a year of revenue. Contract audits matter, but most damage begins elsewhere: in build pipelines, cloud accounts, laptops and access policies.
We treat security as part of delivery. Every artifact is signed, every credential is short-lived, every change is reviewed and every incident has a rehearsed response.
Where it applies
- Supply chain hardeningSigned builds, provenance and verified deploys across CI/CD.
- Key and secret managementHSMs, MPC and vaults, with no secrets on developer machines.
- Edge protectionDDoS defence, WAF and rate limiting for public endpoints.
- Incident readinessDetection, playbooks and game days before you need them.
What we build
Signed supply chain
Reproducible builds, signed artifacts, verified deploys.
Zero-trust identity
Short-lived credentials and hardware-backed access.
Edge defence
Endpoints that keep serving under sustained pressure.
Incident response
Detection, playbooks and calm hands on a bad day.
How we approach it
- 01Assume breach, limit blast radius
- 02Secrets never touch a laptop
- 03Rehearse the bad day
Stack
What you get
- ✦Smaller blast radius when something goes wrong
- ✦Evidence for auditors and partners
- ✦Teams that respond calmly, by playbook
Have a hard problem?
Tell us what you are building. We reply within two working days.