# Security and audits

## Security disclosures

The security disclosure contact is [security@celestia.org](mailto:security@celestia.org).
Do not report vulnerabilities in public issues or discussions. Follow the
[Celestia security policy](https://github.com/celestiaorg/.github/blob/main/SECURITY.md):
submit a private security advisory in the affected repository, or email the
security disclosure contact if private reporting is unavailable.

## Audit reports

This page provides a comprehensive list of audits conducted on various Celestia software, including OP Stack, Nitro, celestia-app, Blobstream, and more. Each audit is linked to its respective report.

| Software                   | Auditor          | Link                                                                                                                       |
| -------------------------- | ---------------- | -------------------------------------------------------------------------------------------------------------------------- |
| OP Stack                   | OtterSec         | [Link](/audits/Celestia_OP_Stack_Audit.pdf)                                                       |
| Nitro                      | OtterSec         | [Link](https://github.com/celestiaorg/nitro/blob/celestia-v2.3.3/audits/celestia/arbitrum_nitro_celestia_audit_report.pdf) |
| v2 celestia-app Lemongrass | Informal Systems | [Link](https://github.com/celestiaorg/celestia-app/blob/main/docs/audit/informal-systems-v2.pdf)                           |
| v3 celestia-app            | Informal Systems | [Link](https://github.com/celestiaorg/celestia-app/blob/main/docs/audit/informal-systems-authored-blobs.pdf)               |
| Blobstream SP1             | OtterSec         | [Link](/audits/SP1_Blobstream_Ottersec_Audit.pdf)                                                 |
| Blobstream SP1             | Multiple         | [Link](https://github.com/succinctlabs/sp1/tree/dev/audits)                                                                |
| Blobstream X               | Informal Systems | [Link](/audits/Blobstream_X-Informal_Systems_Audit.pdf)                                           |
| Blobstream X               | OtterSec         | [Link](/audits/Blobstream_X-OtterSec_Audit.pdf)                                                   |
| Blobstream X               | Veridise         | [Link](/audits/Blobstream_X-Veridise_Audit.pdf)                                                   |
| Blobstream X               | Zellic           | [Link](/audits/Blobstream_X-Zellic_Audit.pdf)                                                     |
| Shwap                      | OtterSec         | [Link](/audits/celestia_shwap_audit_final.pdf)                                                    |
| High throughput recovery   | Informal Systems | [Link](https://github.com/celestiaorg/celestia-app/blob/main/docs/audit/informal-systems-recovery.pdf)                     |