Signal recently launched Automatic Key Verification, a feature that helps validate that your chats are secure without requiring direct safety number comparison. Trail of Bits built and operates one of the three auditors that make this system trustworthy.
Over the first few weeks of Patch the Planet, our engineers found three techniques for using /goal, which hands Codex an open-ended objective and lets it work independently toward a success condition.
In April we released Mewt, our open-source mutation-testing engine that finds the gaps in your test suite. Today we’re expanding it with support for DAML, the language Canton Network applications are written in.
A Patch the Planet field report: GPT-5.5-Cyber built a bespoke zlib fuzzing campaign in a single day, work that once took skilled researchers weeks.
We added post-quantum cryptography support to pyca/cryptography, the eleventh most-downloaded Python package on PyPI, putting quantum-resistant ML-KEM and ML-DSA algorithms one pip install away for the entire Python ecosystem.
Patch the Planet is our joint initiative with OpenAI to assist critical open-source software in the age of machine-speed vulnerability research.
We improved YAML anchor support in zizmor and tested it against 41,253 real-world GitHub Actions workflows from high-value open-source projects.
Trailmark turns source code into a security-analysis graph, powering eight Claude Code skills for blast radius, taint propagation, and mutation test triage.
We’re releasing CoBRA, an open-source tool that simplifies the full range of Mixed Boolean-Arithmetic (MBA) expressions used in the wild.
Today, we’re announcing MuTON and mewt, two new mutation testing tools optimized for agentic use.
Trail of Bits engineers contributed over 375 merged pull requests to more than 90 open-source projects in 2025, including significant work on Sigstore rekor-monitor, the Rust compiler and Clippy, pyca/cryptography’s ASN.1 API, hevm performance optimizations, PyPI Warehouse, and pwndbg.
We collaborated with the Sigstore community to build cryptographic agility into the software signing ecosystem, enabling organizations to use different signing algorithms while maintaining security through predefined algorithm suites and out-of-band configuration rather than dangerous in-band signaling.
We’re getting Sigstore’s rekor-monitor ready for production use, making it easier for developers to detect tampering and unauthorized uses of their identities in the Rekor transparency log.
We’ve released open-source Go implementations of ML-DSA and SLH-DSA.
Checksec Anywhere consolidates fragmented binary security analysis tools into a browser-based platform that analyzes ELF, PE, and Mach-O formats locally without compromising privacy or performance.
We’ve added a pickle file scanner to Fickling that uses an allowlist approach to protect AI/ML environments from malicious pickle files that could compromise models or infrastructure.
Datasig generates compact, unique fingerprints for AI/ML datasets that let you compare training data with high accuracy—without needing access to the raw data itself.
This critical capability helps AIBOM (AI bill of materials) tools detect data-borne vulnerabilities that traditional security tools completely miss.
See how we slashed PyPI’s test suite runtime from 163 to 30 seconds.
The techniques we share can help you dramatically improve your own project’s
testing performance without sacrificing coverage.
We’re working on integrating an ASN.1 API into PyCA Cryptography,
built on top of the same Rust ASN.1 implementation already used by
Cryptography’s X.509 APIs.
Trail of Bits’ independent study finds OpenSearch v2.17.1 is 1.6x faster than Elasticsearch v8.15.4 on Big5 workload and 11% faster on vector search.
Introducing Medusa v1, a cutting-edge fuzzing framework designed to enhance smart contract security.
PyPI now supports marking projects as archived. Project owners can now archive their project to let users know that the project is not expected to receive any more updates. Project archival is a single piece in a larger supply-chain security puzzle: by exposing archival statuses, PyPI enables downstream consumers to make more […]
While Trail of Bits is known for developing security tools like Slither, Medusa, and Fickling, our engineering efforts extend far beyond our own projects. Throughout 2024, our team has been deeply engaged with the broader security ecosystem, tackling challenges in open-source tools and infrastructure that security engineers rely on every day. This year, our engineers […]
Ruby Central hired Trail of Bits to complete a security assessment and a competitive analysis of RubyGems.org, the official package management system for Ruby applications. With over 184+ billion downloads to date, RubyGems.org is critical infrastructure for the Ruby language ecosystem.
For the past year, we’ve worked with the Python Package Index (PyPI) on a new security feature for the Python ecosystem: index-hosted digital attestations, as specified in PEP 740. These attestations improve on traditional PGP signatures (which have been disabled on PyPI) by providing key usability, index verifiability, cryptographic strength, and provenance properties that bring […]
