// METHODOLOGY
Seven phases. No skipped gates.
HashEye combines sandboxed automated analysis with human review, fixed severity rules, immutable report versions, and on-chain verification after publication.
01
INTAKE
audits.status = NEW
- >NDA signed before code is shared.
- >Scope, commit hash, contracts, SLOC, chain, and auditors are locked.
- >Kickoff email confirms timeline and contact path.
02
AUTOMATED DETECTION
tool_runs = RUNNING
- >Layer 1 — Automated Detection Engine runs in isolation.
- >Layer 2 — Pattern Correlation deduplicates signals before review.
- >Layer 3 — Senior Manual Verification signs off every finding — no exceptions.
- >Tool output is encrypted before storage.
03
MANUAL REVIEW
audits.status = IN_PROGRESS
- >Senior auditors verify findings against source code.
- >Severity follows the published matrix.
- >Verdict and executive summary are written after review.
04
REPORT DRAFT
report_versions = v1.0
- >PDF follows the fixed report template.
- >Draft reports are stored behind signed R2 links.
- >Auditors review typography, evidence, and completeness.
05
CLIENT REVIEW
findings.status updated
- >Client responses are captured per finding.
- >Fixed, acknowledged, partial, and wont-fix outcomes are tracked.
- >Critical and high fixes move into remediation review.
06
REMEDIATION
audits.status = RE_AUDIT
- >Re-audits focus only on remediated findings.
- >A new commit hash is locked for changed code.
- >Report versions increment when corrections are published.
07
FINAL REPORT
audits.status = COMPLETE
- >Publication requires verdict, PDF, executive summary, and no unapproved draft findings.
- >Published PDFs use permanent R2 URLs.
- >On-chain registration runs asynchronously after publish.