The register, including the misses.

Proof names two things: the platform that builds the intent graph, and the assurance practice that audits against it. This register is where the practice publishes what it found, what it withdrew, and what it missed. Names go on the promises, on the methodology bar, and on every published miss.

In July 2026, two defects in jsonparser’s Set() got past our review. One silently threw away data: asked to write at index [5] of a two-element array, Set returned a one-element array — valid JSON, nil error, the rest of the data gone. The other panicked on an empty path component, the same failure class a hazard sweep had already found at seven sites and missed at the eighth. The affected code carried 100% MC/DC at the time. That is the uncomfortable part, and the reason this entry leads the register: coverage was complete and the defects got through anyway, because the proof had a gap. The blameless postmortem naming that exact gap is published in the repository, next to the findings and the fixes, where you can re-run all of it. The gate stopped neither defect, and the project’s changelog credits an outside reporter for each — the full account, including where our own records and the changelog disagree, is on public proof.

The context. jsonparser is a Go library that Proof’s founder has maintained for a decade; it went first on purpose, as code we could not hide from. Formalizing its behavior produced 123 requirements — 7 stakeholder, 116 system — and judged against them, the review surfaced six defects on its own. Eight defect files sit on master; the two beyond the six are the outside reports, credited by name in the changelog, and they are the two published misses. The issue register shows four known-issue records, KI-1 standing for a whole panic class across several call sites. Every one of those numbers is a directory or a document in the public repository, and they are counted out object by object on public proof. Under the credit rule this entry is credited upstream: every record counted above is a file on the project’s public master branch, and the changelog credits the two outside reporters by name for the two we missed.

A person validated every finding in this entry before it shipped. People sign Proof’s promises and its methodology bar, and publishing a miss is a person’s decision. The postmortem itself carries no signature, and it says so.

rsync is widely shipped across Linux and Unix systems and has moved the world’s files since 1996. Proof audited it continuously through the development of rsync 3.5.0, alongside Trail of Bits, re-running the whole tripwire suite every time upstream moved. The audit filed 99 findings; the 3.5.0 security release shipped 33 security fixes, six more landed mid-development in the interim 3.4.3 security release, and the cycle carries 39 CVE IDs in all. Ten of the findings had been present since the first release in 1996.

The board keeps its own honest arithmetic: 45 findings open, 21 fixed, 28 withdrawn — the audit disproved its own findings and the board shrank — and 5 re-examined by a person and allowed to stand. That board was read on 30 August 2026, and the audit is still running, so open and fixed move. The release’s 33 fixes include findings from the daemon-protocol fuzzing pass and from researchers beyond this audit, and their work is never counted as ours. Every one of the 33 carries its own entry in the release notes, and the audit is still running. Under the credit rule this entry is credited upstream: the 3.5.0 release notes name Leonid Bugaev in their thanks and again as the reporter on individual fix entries, so the upstream record itself carries the credit.

google/grpc-go is the Go implementation of gRPC, a security-critical RPC framework that carries authorization and transport for a large part of the cloud. Five issues are fixed on master — two of them landed as our own merged pull requests, and two are covered by the vendor’s own published security advisories. One more fix is in review, and one issue was withdrawn by agreement as intended behaviour.

Under the credit rule, the five split. Two are credited upstream: our own merged pull requests, filed under this practice’s public account, so the upstream record is our filing. Two more are not credited upstream — the report went through the vendor’s private security process, the fix is public, our dated report predates it, and the public record does not name us. The fifth is credited to another reporter: the vendor advisory covering that class names someone else. We publish ours because we hold a dated report that predates the fix, and the label says what the public record shows. The withdrawn issue and the fix in review are both our own public filings. Each of these, with its public evidence, is on the public roster. Reports still working through a vendor’s process, and anything we reported privately, are not published until they are public and closed.

graphql-hive/router is a GraphQL federation router. Six issues are fixed on main, and one was withdrawn by agreement as intended behaviour. Each one is a public pull request or issue you can open.

We publish these because the work should be checkable, not because it flatters us. Under the credit rule, two of the six are credited upstream: the upstream pull request that fixed each one links to our own dated public issue. The other four are not credited upstream — reported through the vendor’s own channel, fixed in public afterwards, with no mention of us in the upstream record. The withdrawn item is our own public issue, which we closed by agreement. Every fix here is on the public roster with its evidence. Reports still open, and anything we made privately, stay off the public page until they are public and closed.

wundergraph/graphql-go-tools is the GraphQL federation engine underneath a range of production gateways. A cluster of issues we reported was fixed on master, and the fixes landed as the vendor’s own pull requests.

This engagement also produced hardening items held off public disclosure by written agreement, and reports that are still open. Both are omitted here entirely, and this entry represents no count of either — it shows only what is fixed and public. Under the credit rule, all eight are not credited upstream: we reported them into the vendor’s own channel, the fixes are public and dated after our reports, and none of the eight upstream pull requests names us, which is the normal outcome for a report made through a vendor’s channel. Each fix, with its public pull request, is on the public roster.

A reproducer pins the finding one of two ways: it fails until the fix lands, or it asserts the broken behavior while that behavior is live and flips when the fix lands. The record says which, and it never tells the easier story of the two. When a fix is verified, the reproducer stays in the client’s CI as a regression pin, and the defect record preserves the root cause, the severity basis and the evidence.

This register has to earn the right to be believed, and open source is the only place it can. Proof does not publish private customer corpora, even for marketing, because the requirement graph can describe the product almost as completely as the source itself. So the public record grows one self-funded open-source audit at a time, and paying our own way keeps the entries free of anyone’s release marketing.