About ZK Security

ZK Security is built and maintained by Scott Carlson through Savy Advisors LLC.

Scott has been in information security since 1996. Over three decades he's worked across enterprise security, identity and access management, and payment systems — including roles at PayPal, BeyondTrust, and Kudelski Security.

In 2017 he moved into blockchain security full-time. Since then he's participated in the first security audits of Solana, Circle's on-chain infrastructure, and numerous other protocol launches. At Kudelski Security he authored the Digital Asset Custody Research Paper — a widely referenced report on custody deployment models and security architectures.

Zero-knowledge systems concentrate value behind a small set of constraints, and few people can audit a circuit. Advice about which auditor to hire often comes from someone with a commercial relationship to a firm. This site has commercial relationships too. They are described in the card below and on the editorial policy.

ZK Security is a directory of ZK tooling and ZK-capable audit firms, with original guides on circuit security and a research feed of proving-system vulnerabilities. Practitioner experience sets the editorial direction. A research note is published only when it clears the quality gate described in the editorial policy.

Connect with Scott on LinkedIn

Zero-knowledge bugs don't look like ordinary smart-contract bugs. An under-constrained circuit compiles, passes its tests, and generates valid-looking proofs — right up until someone crafts a witness the developers never intended and the verifier happily accepts it. Traditional audit checklists barely touch this failure mode.

The tooling, the auditor skill set, and the incident history of ZK systems are all distinct enough from general Web3 security that teams deserve a resource focused on exactly this: proving systems, circuit languages, constraint analysis, trusted setup hygiene, and verifier integration.

ZK Security tracks that landscape continuously — which firms have real circuit audit track records, which analyzers actually catch constraint bugs, and what the latest proving-system disclosures mean for your stack.

Every tool and auditor in our directory goes through a multi-step evaluation:

1. Discovery — AI pipelines scan GitHub, ZK research forums, audit report archives, and vulnerability disclosures for new tools and firms.
2. Verification — Claims are verified against public data: published audit reports, GitHub activity, and community reputation.
3. Expert Review — Practitioner review adds context automation can't capture — like whether a constraint analyzer holds up in real audit workflows.
4. Continuous Monitoring — Listings are re-evaluated regularly. Inactive tools get flagged, stale entries get demoted, and new data is incorporated automatically.