RecheckableClaim the page for Garbles Labs
Claiming is free and takes about a minute. It proves that your team controls the project’s upgrade authority, official domain or GitHub organisation. You can then add your own statements and respond next to any check, get the embeddable badge and ask for unlisting. Claiming never changes the automated score, and we do not review your statements.
A. Sign with your wallet
An off-chain message signature. It sends no transaction, costs no SOL and gives no access to funds. It works for the address that holds the upgrade authority of a listed program, or a member of the multisig / DAO council that holds it.
Advanced: sign with another tool
B. Add a DNS record
Works for any project with an official domain, i.e. one linked from the project's own listing, GitHub or on-chain security.txt. The record must stay in place.
TXTC. Publish a file
Publish one line of text where only the project can write: on your own website, or in a repository of your GitHub organisation. That proves control, because nobody else can put a file there. The file must stay in place.
recheckable-claim=garbles-labs:<your one-time code>- The line contains only the project's name in our list and a random one-time code. No wallet address, key, password or personal data.
- Pressing the button below only shows you your code. It does not change anything, sign anything or send anything. The file is only created if you publish it yourself.
- Publish it within 7 days. Keep the file in place afterwards: if it is gone for 14 days in a row, we ask you to claim again.
GitHub rules
The repository must be public, owned by a GitHub organisation (not a personal account), not a fork and not archived. The organisation must be linked to the project by its listing, its on-chain security.txt, or its website (a link from the homepage, with the website also set on the organisation's GitHub profile).
For the DNS record, two independent public resolvers (Cloudflare and Google) must both show it. For the file, we fetch it over https and show the URL, status and a hash in our records so anyone can open the same URL. We never ask for a seed phrase, a transaction or a payment. Wrong party? Send a correction.
What would show up as met
Open checks for this page, with what each one looks for. The tick boxes are only for you; nothing is saved. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score. See all checks.
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
- Nothing to configure: a deploy more than 30 days ago reads as met, a more recent deploy as partial because the code changed recently.
- Link each audit report from an official page: your docs, your website or an audits folder in your GitHub repository.
- Tell us the page through the corrections form so it can be added. The check only confirms that the document is reachable. It does not assess the audit’s quality or whether it covers the current code.
- Send these four response headers on your homepage: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options.
- The check looks only at whether each header is present, not how strict it is.
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
Contact:line, for exampleContact: mailto:security@your-domain. - RFC 9116 also asks for an
Expires:line. We look only forContact:, but addExpires:too so the file stays correct.
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
- Link your bug bounty (for example an Immunefi, HackerOne or Cantina page, or a /bug-bounty page of your own) from the homepage, the sitemap or your security.txt.
- “Unknown” here means we found no link. It does not mean you have no programme.
- Link both a Terms page and a Privacy Policy page from the homepage, or list them in sitemap.xml.
- We check that the pages exist. We do not read or assess their content.
- Nothing to configure: a domain registered more than a year ago reads as met, 90 days to a year as partial.
- Publish your official program addresses on your own domain and link your GitHub organisation from the website, so the three can be tied together.
- List your official program addresses on a page of your own domain (for example a docs page called “Addresses”). A list only on GitHub reads as partial, and one only on a third-party page as not met.
- Name the legal entity behind the project in the terms or privacy text, for example “Example Labs Ltd” or “Example Foundation”.
- We do not check a company registry.