diff --git a/README.md b/README.md index c53d5b0..dacc2fd 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,7 @@ - [Podcasts](#podcasts) - [Webinars](#webinars) - [Public Comments](#public-comments) + - [Case Studies](#case-studies) - [Security Reviews](#security-reviews) - [Major Clients](#major-clients) - [Frax Finance](#frax-finance) @@ -416,6 +417,18 @@ | [Understanding Crypto Markets Security](https://github.com/trailofbits/publications/blob/master/presentations/public/CFTC_TAC_presentation_March_2023.pdf) | CFTC | Mar 2023 | | [Regulation of Intrusion and Surveillance Software](https://www.regulations.gov/document/BIS-2015-0011-0209) | Commerce Dept | Jul 2015 | +## Case Studies + +In-depth looks at how clients have worked with Trail of Bits: the challenge, our approach, and the outcomes. Level of effort is in engineer-weeks. + +| Client | Focus | Date | Level of
Effort | Case Study | +| --- | --- | --: | :-: | :-: | +| [Turnkey](https://www.turnkey.com/) | TEE and AWS Nitro Enclaves infrastructure | Jun 2026 | 8 | [📖](case-studies/turnkey-casestudy.pdf) | +| [Vanta](https://www.vanta.com/) | Multi-tenant isolation architecture review | Nov – Dec 2025 | 6 | [📖](case-studies/vanta-casestudy.pdf) | +| [Scopely](https://www.monopolygo.com/) | Monopoly GO! PRNG fairness design assessment | Dec 2024 | 2 | [📖](case-studies/scopely-monopolygo-casestudy.pdf) | +| [Hugging Face](https://huggingface.co/gradio) | Gradio 5.0 pre-release security assessment | Jun – Jul 2024 | 4 | [📖](case-studies/huggingface-gradio-casestudy.pdf) | +| [Scroll](https://scroll.io/) | zkEVM circuit security reviews | Apr – Sep 2023 | 45.8 | [📖](case-studies/scroll-zkevm-casestudy.pdf) | + ## Security Reviews Companies that have allowed us to speak about our work can be found here. Many more remain confidential. @@ -1278,6 +1291,7 @@ Check the [exploits repository](https://github.com/trailofbits/exploits) too. | ✅ | Fix review report | | 🔖 | Letter of Attestation | | 📛 | Threat Model report | +| 📖 | Case study | | 📰 | Whitepaper | | Header | Definition | diff --git a/case-studies/huggingface-gradio-casestudy.pdf b/case-studies/huggingface-gradio-casestudy.pdf new file mode 100644 index 0000000..c8f201e Binary files /dev/null and b/case-studies/huggingface-gradio-casestudy.pdf differ diff --git a/case-studies/scopely-monopolygo-casestudy.pdf b/case-studies/scopely-monopolygo-casestudy.pdf new file mode 100644 index 0000000..a8f2971 Binary files /dev/null and b/case-studies/scopely-monopolygo-casestudy.pdf differ diff --git a/case-studies/scroll-zkevm-casestudy.pdf b/case-studies/scroll-zkevm-casestudy.pdf new file mode 100644 index 0000000..ca672b8 Binary files /dev/null and b/case-studies/scroll-zkevm-casestudy.pdf differ diff --git a/case-studies/turnkey-casestudy.pdf b/case-studies/turnkey-casestudy.pdf new file mode 100644 index 0000000..2dad60b Binary files /dev/null and b/case-studies/turnkey-casestudy.pdf differ diff --git a/case-studies/vanta-casestudy.pdf b/case-studies/vanta-casestudy.pdf new file mode 100644 index 0000000..b7a59da Binary files /dev/null and b/case-studies/vanta-casestudy.pdf differ