> For the complete documentation index, see [llms.txt](https://docs.loadout.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.loadout.xyz/security-and-audits.md).

# Security & Audits

We use independent reviews, testing and remediation to improve the security of Loadout. Each audit covers the programs and code version identified in that report. An earlier report does not automatically cover a later upgrade.

### Published reports

**Hashlock: Loadout 5th Smart Contract Audit Report, Final Report.**

[Download the published final report](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmOBfrcWAZt92QYpN5aiF%2Fuploads%2FmtE4i2rVJebki6fvsJtk%2FLoadout%205th%20Smart%20Contract%20Audit%20Report%20-%20Final%20Report%20.pdf?alt=media\&token=bf1692a7-eea1-4f8e-bf0d-166707637c19)

Read the report's scope, reviewed version, findings and resolutions together. Its presence here does not establish that every program or later release has the same review coverage.

### Current release reviews

Further core-program and staking reviews are being worked through for the new release. We'll add the final reports after the fixes and remediation review are complete. Code changes alone do not establish final auditor sign-off.

Each new report will identify its auditor, date, scope, reviewed version and finding status. Any accepted or unresolved findings need to remain visible in the report. Earlier reports stay available as the history of the versions they reviewed.

Audits reduce risk. They cannot guarantee that software has no bugs or that a token, game or staking position will perform well.

### Reporting a vulnerability

If you find a potential vulnerability in Loadout's website, app or smart contracts, report it privately to <support@loadout.xyz>.

Include the affected component, URL or program address, a description of the issue and its potential impact, and steps to reproduce it. Screenshots, logs or a minimal proof of concept can help.

Never include private keys, seed phrases or other credentials.

We aim to acknowledge reports within 3 business days. Resolution time depends on the issue's severity and complexity. Keep vulnerability details private until a fix is available and coordinate disclosure with us.