Independent audits, published in full. A standing Security Council reviewing what happens between them. Every finding public, including the ones we chose not to fix.
Independent Review
Public reports make the reviewed scope, methodology, and findings available for anyone to inspect.
Covered
Completion date
August 5, 2026
Credshields assessment identified a total of 34 findings, none of which were Critical. The findings include 3 High-severity issues, 11 Medium-severity issues, 12 Low-severity issues, and 8 Informational observations. Upon retest, 30 of the original 34 findings were confirmed as fixed, demonstrating progress in addressing the identified vulnerabilities. The remaining 4 findings have been acknowledged by the Surge team.
Covered
Completion date
July 22, 2026
Ngu Services LLC principal Brandon Black (@reardencode) reviewed and audited the Surge Credit system. After prompt remediation of initial findings, the system is found to be free of material defects in security or suitability within the audit scope and the abilities of the auditor. The Surge Credit on-chain contract, relayer API and logic, and signer interactions were reviewed in detail.
Standing Oversight
An audit is a point-in-time review. The Security Council is the standing group that reviews everything in between, independent practitioners with a remit across the whole stack.
Bitcoin protocol developer and security consultant.
Brandon works on Bitcoin's scripting and covenant research, and is co-author of BIP-348 (CHECKSIGFROMSTACK). He writes rbitcoin, a Bitcoin full node implemented in Rust. In July 2026 he audited Surge's Bitcoin layer, the on-chain Line of Credit contract, the DCN signer software, and the relayers.
Coverage
We don't run a formal bounty programme yet, but we assess every report on its merits and compensate for material findings. Responsible disclosure gets a response from an engineer within one business day.
