Auditing your contract is now 3 steps: upload it, let the agents work, download a full PDF report in minutes. The new SavantChat is live, and it finds the vulnerabilities before attackers do. New here? Claim $75 in free credits, no card, and run your first audit today. savant.chat

The security teams at @Apple, @Google, @Microsoft and @awscloud are some of the best on the planet, and their critical bug count still went from under 100 a month to over 600 since spring. If that’s happening to them, it’s happening to the rest of the stack too, and not only to the contract. SavantChat audits any code: smart contracts, backends, bots, nodes, front-ends. Every finding comes with a proof of concept, so your team spends its time on bugs that are real. The bugs in your code will get found either way. Better if it’s you. savant.chat

Pre-flight check: passed.

Until this week, every SavantChat audit started with someone opening savant.chat. Now it can start with one line to the coding agent you already work with, and the engine got sturdier on the repos that used to trip it up. ▸ Agent API keys: create one under Settings › API keys, choose who it acts for, what it may do and an optional expiry, then give it a monthly spend limit. ▸ SavantChat in Claude Code, Cursor and Codex: paste the setup prompt into your agent and it can price an audit, start one up to a price cap, track it and read the findings, straight from its working copy with no GitHub needed. ▸ Repos that mix Foundry and Hardhat are now accepted, and Foundry projects keep going when their own tests need network access or already fail. ▸ .NET and TypeScript audits got a round of setup fixes, so they no longer stop early or finish having examined nothing. ▸ One failing area or finding no longer cancels the whole audit, and repos past 2,000 auditable files now import while you uncheck folders until it fits. ▸ Plus smaller fixes across checkout, the commit picker and the GitHub connect flow. So the loop now looks like this: your agent writes the feature, sends it to SavantChat under the cap you set, and the findings are waiting before you merge. Give it a try on your next PR.

What happens to your code between upload and report in @savantchat. 4 stages, and why each one exists. 1/ Code and docs, paired Every audit starts by matching the code with its documentation. Many logic bugs only show up as a gap between what the spec promises and what the code does. A contract read without its docs is a puzzle. 2/ Passes from a blank slate One prompt is systematically not enough. The auditor agent runs pass after pass, each in a clean context with only the previous findings carried over. There's no checklist in sight, so it invents attack paths instead of hunting for familiar ones. 3/ The reference book, last Only the final pass opens the database: 200+ vulnerability classes distilled from 20,000 real exploits. Give a model known patterns first and it anchors on them and walks past newer bugs. Moving the book to the end lifted detection by 20–50% on an independent benchmark. 4/ A critic that has to break it A typical single-pass scan returns 16 findings, 1 of them valid. So on Advanced and Pro, a critic agent tries to build a working PoC for every finding. No PoC, and the severity drops or the finding is rejected. Then deduplication, then your report. 10–30 minutes for a typical codebase.

Most devs review contracts, but the infra around them gets a pass. Nice to see builders in the @strato_net ecosystem following best practices. Their niche leaves no room for shortcuts. StratoBot tracks lending positions, health factors and liquidation risk for STRATO users, so before scaling it, Jaghatai ran the code through SavantChat. SavantChat audits this layer too: bots, backends, scripts, all the code users rely on around a protocol, and every finding comes with a proof of concept. Checking the tooling around a protocol is the right habit. Thanks for building in public, @JaghataiKhans!

Singapore recap 🇸🇬 @token2049 felt quieter than last year. Yet fewer crowds meant longer, better conversations, and the floor was full of new teams we hadn’t met before. Our highlight came on Saturday, though. @igorgulamov took the @AITinkerers Singapore stage and showed our auditor at work, live. Judging by the conversations afterwards, it landed (photos and a short cut from the demo are below). More stages like that are coming. And New York ( June 16-17, 2027) is already on the calendar.

In about an hour, @igorgulamov takes the stage at @AITinkerers. He'll point a multi-agent auditor at a vulnerable repo, live, and show how it turns suspected bugs into working exploits before anything makes the report. If you're coming, don't be late. It's 5 minutes and you won't want to miss the start.

Busy week at SavantChat: a CVP approval from @AnthropicAI, networking on the @token2049 floor, and final prep for tomorrow's demo at @AITinkerers Singapore. Meanwhile, the dev team kept shipping: ▸ Report a problem: send us a description and an optional screenshot straight from the app, from the sidebar, the user menu, or an audit that stopped. Our team replies by email. ▸ Download PoC files: when a completed audit includes proof-of-concept exploits, grab them as artifacts zip from the report's download menu. ▸ Payment links: edit a link's amount, note or expiry, and delete the ones you no longer need. The Payment links window on Billing got a new design too. ▸ Top up from the audit form: if your balance is short, Start audit offers a one-click top-up with the missing amount already filled in on Billing. ▸ Supporting documents: each one uploads as soon as you add it, with its own progress and price. On wide screens they sit in a side panel next to your files, and pages that couldn't be fetched can be retried. ▸ The price on every tab now includes your supporting documents, and any shortfall shows before you click Start. ▸ Documentation crawls no longer get stuck when the connection drops. Team favorite this week: artifacts zip. The exploit that proved the bug now leaves the report with you.

SavantChat has been approved for @AnthropicAI’s Cyber Verification Program! We use @claudeai to build SavantChat: for engineering work, orchestrating complex development, it’s the best LLM we’ve worked with. Until now, cyber safeguards kept getting in the way. Almost every component that makes the auditor better touches vulnerability data, and that work kept getting blocked. With CVP, that’s no longer the case. We can build the tooling behind SavantChat at full speed. The audit itself still comes from the pipeline we built: multiple passes, 200+ vulnerability classes drawn from 20,000 real exploits, and a PoC gate every finding has to clear.

Igor Gulamov @igorgulamov, our co-founder, is giving a live demo at @AITinkerers Singapore this Saturday, October 10. The talk: “The PoC Gate: a multi-agent auditor that can’t report a bug it can’t exploit.” 5 minutes on a vulnerable repo, where every finding has to survive a working exploit before it reaches the report. He’ll show the traces, and where the gate still breaks. The meetup runs 9:30 to 12:30 Singapore time at Singtel 8George, with demos from 10:40. Entry by application: singapore.aitinkerers.org/p/… See you there!

Fair trade for @token2049: you show @alexgulamova a contract, she shows you what SavantChat finds in it. She's at Marina Bay Sands through tomorrow. DM her a repo or PR link, grab a coffee, and come back to the results. On Advanced, every finding ships with a working PoC. And keep Saturday morning free. More on that tomorrow.

September was the worst month for crypto security since February 2025: $742M stolen across 33 incidents, ahead of April's $648M. (Source: @DefiLlama) 2 incidents made up 95% of it: • @bitget lost $387M after attackers used zero-days in third-party security appliances to push forged withdrawals from its hot wallets. • @Liquid_BTC lost $320M to a bug in its node's proof validation that let an attacker mint 4,000 unbacked L-BTC. $268M of it was later returned. Take those 2 out, and DeFi had its quietest month in a while: $25.7M lost across 24 protocols, down from $150.5M in August. The biggest losses came from exchange backends and the chain's own node software.

KBW 2026 is a wrap 🇰🇷 3 days at Walkerhill, a lineup that ran from Balaji to Jeff Yan, and more good conversations than we could fit into the calendar. One talk stayed with us. OtterSec had a slide that said "the tools around the model matter": code context, tests and feedback loops built around the LLM. SavantChat is built on that same idea, and it was good to hear it from a stage at Asia's biggest crypto week. Thanks to everyone who found us. We're heading home with full notebooks and an Upbit ice pop coupon we fully intend to use. Yet, the autumn run isn't over. There are 2 more stops before the year ends, and at both of them we'll be doing more than listening. More on that soon 🤫 Next stop is Singapore. @token2049 takes over the city on October 7-8, and we'll be in town. If you want to meet, @alexgulamova and @igorgulamov have their DMs open.

This week we worked on payments and uploads: a new checkout with official invoices, uploads that hold up on slow connections, and a guarantee that verification never touches your source code. ▸ New checkout: top-ups now go through a secure checkout run by our payment partner, Dodo Payments. Pay by card, stablecoins, or Apple Pay and Google Pay where your device and region support them. ▸ Official invoices: every top-up gets an official invoice from Dodo Payments as the seller of record, ready to download from your billing history. ▸ Large uploads on slow connections: uploads used to cut off after 15 seconds. They now keep going for up to 30 minutes while data is flowing, and if one does time out, you get a clear message instead of a generic error. ▸ Empty files, like an empty .gitattributes, no longer block an upload. They're left out of the audit and listed as excluded. ▸ Your code stays untouched: preparing the verification environment is checked automatically so it can't change your project's source. Only tests, and import paths in the audited files, may be adjusted. ▸ Plus several stability and performance improvements across audits. So this week: easier to pay, harder to break an upload, and your source stays yours.

Topping up SavantChat just got simpler. ▸ Pay by card or in USDC on Ethereum, Solana, Polygon or Base. ▸ $USDC is a QR scan from your wallet, no browser extension needed. ▸ Buying for a company? Get an invoice in your company's name, with tax handled at checkout. ▸ Someone else holds the card? Send them a payment link and they pay for you. Fewer steps between you and your next audit. savant.chat/dashboard/billin…

#KBW2026 day 2 🇰🇷 Seoul, you made it really hard to stay inside the venue today. Autumn in this city is something else. But the main stage keeps pulling us back in: @fundstrat calling a bull market, @CryptoHayes saying the currency for AI agent payments doesn't exist yet, and a lot of talk about tokenization moving past finance. 서울 사랑해 @kbwofficial

SavantChat is in Seoul for @kbwofficial 🇰🇷 @igorgulamov and @alexgulamova are around through Oct 4. If you want to meet up and talk smart contract security or AI audits, their DMs are open.

Society if we all ran SavantChat before deploy.

This week we worked on transparency and reliability in the audit pipeline: a permanent activity record for every audit, steadier finding verification, and less waiting around top-ups and imports. ▸ See what your audit did. Every completed audit now keeps a permanent record of which phases ran, how long each took, how many potential issues were checked and dismissed on review, and which verdicts were reached, so a clean report with zero findings still shows the work behind it. The report summary now covers the whole audit. ▸ Faster, more reliable verification. The environment for verifying findings is now prepared in its own step while the audit runs, not after it. ▸ Better support for Foundry projects that reach contracts through project imports and vendored dependency folders. ▸ Crypto top-ups are credited as soon as the payment confirms, not up to 10 minutes later. ▸ Repository imports on the New Audit page no longer leave you on a spinner for up to 30 seconds. ▸ Every file in the scope tree can now show its details, such as why it was excluded, with long details expandable. ▸ Audit progress no longer shows internal error text. TL;DR. Audits now show their work, verification is steadier, and there's less waiting around them.

Glad to be on the @CRX_FX run through @sherlockdefi's Audit Engine. This wasn't a typical Solidity repo: a zkVM risk engine and an FX clearing core, with Rust in scope. SavantChat finished #1 on coverage, unique findings and weighted score: 14 of the 21 accepted findings, 10 of them nobody else surfaced, and a weighted score of 16.