Audits

Every independent review of Vallkey is listed here, with its full report, unedited: the firm, the date, what was in scope, every finding by severity, and how each was fixed.

What reviews cover

Review	What it covers	How often
Cryptographic design	Every format and protocol in Vallkey’s specification, checked against its test vectors	With each major change to the design
Code audit	The shared core, the server and every app	Every year
Penetration test	The hosted service, in each region	Every year

Between reviews

• Every cryptographic format is specified in full, with known-answer test vectors that a second, independent implementation checks on every change. The firms that review Vallkey get both.
• Every change runs the full test suites, dependency audits and lints before it’s merged.

Reports

Each report is published here the day we receive it, with nothing taken out.