Editorial policy and rating methodology

Published by ZK Security. Operated by Savy Advisors LLC, an Arizona limited liability company, Buckeye, Arizona.

Who operates zksecurity.io, what is allowed to look like an article, how a tool or auditor rating is built, and which commercial relationships the operator may have.

What this site publishes

ZK Security is operated by Savy Advisors LLC, an Arizona limited liability company (Arizona entity 23477457). Scott Carlson is President of Savy Advisors LLC. The about page is the biography, the entity, and the mailing address. This page is the policy. Guides and research notes are published by ZK Security.

Guides on Learn are original circuit-security writing. They are the pages this site expects a reader to spend time on. Each guide names the tools and firms it depends on, and those names link into the directories.

Directory hubs — the tool directory and the auditor directory — carry the comparison. Individual tool and auditor profiles repeat a short public summary so a reader can jump to a repository or a firm. A profile is not treated as an article. It stays out of the sitemap and is marked noindex until its own prose is long enough to stand alone. The shared page chrome, tag lists, and rating widgets do not count toward that bar.

Research notes on the research feed are published only when they pass the quality gate: enough original prose, on the zero-knowledge security topic, with no generator scaffolding, and either a recorded truth-gate pass or a recorded claim-level review. Stubs, prompt leaks, and off-topic files never publish. Notes are updated when a cited primary changes in a material way, not on a calendar.

Commercial relationships. Savy Advisors LLC may earn referral fees from auditors, fees for premium auditor listings, affiliate commissions, content-sponsorship revenue, and display-advertising revenue. Guides and the 1–5 ratings are editorial judgments based on public reports and repositories. A paid listing, affiliate link, or sponsorship is labeled, is not the editorial Featured mark, and does not set the rating. Display ads run on the about page, this policy, and on guides and research notes that clear the length floor. Directory profiles, the contact form, and the legal pages do not load an ad unit.

Corrections. If a listing, a date, or a factual claim is wrong, write to us and point at the public source. A rating moves when the public record moves. It does not move because someone asked for a higher number.

The Rating Scale

Auditors are rated on a 1 to 5 scale based on a weighted evaluation across six criteria. Tools are evaluated qualitatively across five dimensions and ranked within their category.

1
Significant concerns
2
Below average
3
Competent
4
Strong
5
Exceptional

Auditor Rating Criteria

There is no industry standard for scoring audit firms. This methodology is our own, developed from years of working with auditors and observing real-world outcomes. Each criterion carries a specific weight in the final 1-5 rating.

Portfolio Depth

25%

Number and quality of publicly available audit reports. We look at severity depth of findings, quality of remediation guidance, and consistency across engagements.

  • How many public audit reports has the firm published?
  • Do reports include detailed finding descriptions and fix recommendations?
  • Are findings categorized with clear severity ratings?
  • Is there consistency in thoroughness across different clients?

Proving-System Coverage & Specialization

15%

Breadth of proving-system expertise and depth of specialization in specific ZK stacks.

  • Which proving systems (Groth16, PLONK, STARKs, zkVMs) has the firm audited?
  • Do they specialize in specific stacks (circom, halo2, Noir, Cairo, gnark)?
  • Can they audit both circuits and the surrounding verifier integration?
  • Do they have ZK-specific tooling and methodology?

Team Size & Known Personnel

10%

The people matter more than the logo. We assess team size, the visibility of lead auditors, and whether the firm relies on known senior researchers or unvetted juniors.

  • How many staff can genuinely audit ZK circuits and cryptographic protocols?
  • Are lead auditors publicly known with verifiable track records?
  • Do they have researchers contributing to the broader security community?
  • Can clients request specific auditors for their engagement?

Community Reputation & Track Record

25%

What the security community actually thinks, combined with post-audit outcomes. We track soundness bugs surfaced in audited systems and weigh researcher sentiment.

  • Have soundness bugs surfaced in systems this firm audited, and how were they handled?
  • What do bug bounty hunters and independent researchers say?
  • Is the firm recognized by peers in the audit community?
  • Have they been involved in any controversy or disputed findings?

Turnaround Reliability

10%

How responsive the firm is from initial contact through final report delivery. A great audit that arrives six months late can be worse than a good audit on time.

  • What is the typical turnaround time for a standard engagement?
  • How responsive are they during the scoping and quoting phase?
  • Do they meet stated deadlines consistently?
  • Is post-audit support and re-audit available promptly?

Public Transparency

15%

Firms that publish their reports, disclose their methodology, and operate openly score higher. Transparency is a quality signal.

  • Are audit reports published publicly (with client permission)?
  • Does the firm disclose its audit methodology?
  • Are team credentials and qualifications verifiable?
  • Do they maintain a public portfolio or reports page?

Tool Evaluation Criteria

Tools are evaluated qualitatively and ranked within their category (static analyzers, fuzzers, monitoring, etc.). Since tools don't carry a single numeric rating, we assess them across these five dimensions and present our editorial recommendation.

GitHub Activity & Maintenance

Is the tool actively maintained? We look at commit frequency, issue response times, release cadence, and whether dependencies are kept current.

  • Commit frequency in the last 90 days
  • Open issue and PR response times
  • Release cadence and changelog quality
  • Dependency freshness and security patch adoption

Community Adoption

Real-world usage matters more than marketing. We track downloads, GitHub stars, mentions in audit reports, and adoption by recognized security researchers.

  • GitHub stars and fork count trends
  • Package manager download statistics (npm, pip, cargo)
  • Usage in published audit reports and security research
  • Adoption by top audit firms in their workflows

Documentation Quality

A powerful tool with terrible docs is a powerful tool nobody uses correctly. We evaluate getting-started guides, API references, and example quality.

  • Does it have a clear getting-started guide?
  • Are all features and configuration options documented?
  • Are there real-world usage examples?
  • Is the documentation kept in sync with releases?

Feature Completeness

How well does the tool cover its stated category? A static analyzer should catch the known vulnerability classes. A fuzzer should support property-based testing. We compare against category expectations.

  • Coverage of ZK bug classes (under-constrained circuits, unsound gadgets, bad Fiat-Shamir)
  • Constraint-bug detection accuracy and false positive rates
  • Proving-system and circuit-language support breadth
  • Integration with ZK development workflows (circom, halo2, Noir, Cairo)

Active Development Status

Is the project alive, on life support, or abandoned? We distinguish between stable-and-mature (good) and unmaintained-and-stale (bad).

  • Last commit date and release date
  • Roadmap or public development plans
  • Maintainer responsiveness to community issues
  • Whether the project is accepting contributions

What "Featured" Means

A tool or auditor marked Featured is the editorial pick from the criteria on this page. Savy Advisors LLC may earn referral fees from auditors, fees for premium auditor listings, affiliate commissions, content-sponsorship revenue, and display-advertising revenue. Guides and the 1–5 ratings are editorial judgments based on public reports and repositories. A paid listing, affiliate link, or sponsorship is labeled, is not the editorial Featured mark, and does not set the rating.

Important Disclaimers

  • Editorial opinion. Ratings are editorial assessments based on publicly available information. They are not guarantees of audit quality or tool effectiveness.
  • Commercial relationships. Savy Advisors LLC may earn referral fees from auditors, fees for premium auditor listings, affiliate commissions, content-sponsorship revenue, and display-advertising revenue. Guides and the 1–5 ratings are editorial judgments based on public reports and repositories. A paid listing, affiliate link, or sponsorship is labeled, is not the editorial Featured mark, and does not set the rating.
  • Continuously updated. Ratings are updated as new information becomes available. A firm's rating today may change as they publish new reports, expand to new proving systems, or as post-audit outcomes emerge.
  • Known limitations. Post-audit exploit data is incomplete. Newer firms have less data to evaluate. Community sentiment can be influenced by marketing. We disclose these gaps rather than pretend they don't exist.

Think We Got Something Wrong?

If you believe your listing is inaccurate, your rating doesn't reflect current information, or we're missing important data, we want to hear from you. We take corrections seriously.

Contact Us