QUICKSTART

Get from zero to a live security score in under ten minutes. CONTROL reads your on-chain and operational state, runs eight control checks, and keeps the result continuously updated.

A typical first scan surfaces 5–15 findings. Don't panic — most protocols start in the 55–70 range. The register turns each finding into an owned, dated task; teams that work it daily usually cross 85 within a month.

CORE CONCEPTS

CONTROL treats operational security as a continuous process, not a point-in-time audit. Three objects make up the system:

SECURITY SCORE

The score starts at 100 and subtracts penalties: each failing check costs its weight (4–8 points), each open risk costs by severity (critical −6, high −4, medium −2). Scores map to grades: A ≥ 90, B ≥ 75, C ≥ 60, below 60 is flagged.

CHECK WEIGHTS

Every protocol runs the same eight core checks with the same weights, so scores stay comparable across the ecosystem.

ACCESS CONTROL

CONTROL builds a permission graph of who can touch what: contract admin roles, multisig signers, GitHub maintainers, cloud IAM and Discord elevated roles. Each grant carries an owner, a justification and a review date.

• Quarterly reviews — every grant must be re-approved or revoked; overdue reviews fail the check.
• Ghost detection — accounts with access but no activity in 60 days are flagged automatically.
• Least privilege — role templates (Admin, Security, Engineer, Ops) keep grants minimal by default.

TREASURY & WALLETS

Register every protocol wallet — treasury Safe, ops multisigs, deployers, hot wallets. CONTROL watches them on-chain and fails the check on drift:

• Signer set or threshold changed without a logged approval.
• Funds above a policy cap held in a single-signer wallet.
• Deployer EOAs that still hold upgrade rights after launch.
• Unusual outflow velocity versus a 30-day baseline.

RISK REGISTER

Log risks manually or from failed checks. Every risk needs an owner and a due date — unowned risks escalate to admins after 48 hours, and overdue criticals page the on-call. Closing a risk requires a resolution note, which feeds your audit trail.

INCIDENT RESPONSE

Declare an incident from any alert or manually. CONTROL opens a timeline, notifies the on-call rotation, and pins the relevant runbook. Incidents can't be closed without a post-mortem — the discipline is the product.

• Severity ladder — SEV-1 (funds at risk) pages everyone; SEV-3 notifies the channel.
• Runbooks — pre-written playbooks for bridge pause, oracle halt, key compromise, governance attack.
• Drills — a quarterly tabletop drill is required to keep the INCIDENT PLAN check passing.

KEY ROTATION

Every credential gets an age: deployer keys, API tokens, webhook secrets, cloud keys. Policy defaults to 90 days (configurable in Settings). At 80% of the window the owner is nudged; past the window the KEY ROTATION check fails and a risk is auto-logged with the owner pre-assigned.

BACKUPS

A backup that has never been restored is a hope, not a control. CONTROL tracks snapshot freshness for configs, secrets and off-chain state, and requires a verified restore test weekly — the check fails on stale snapshots or failed restore drills, not just missing backups.

CI/CD CHECKLIST

The pipeline is an attack surface. With the GitHub connector installed, CONTROL verifies on every deploy:

• Two-person review enforced on protected branches.
• Signed, reproducible builds — artifact hash matches source.
• Secrets kept out of CI logs and env files.
• Staging → production separation with distinct credentials.

TRUST BADGE

Enable the public profile in Settings to publish your score at control.xyz/<slug>. Embed the live badge anywhere:

The public profile shows only the score, grade and PASS/FAIL per check — never risk details, wallet addresses or team members. The badge updates within 60 seconds of any state change.

CONNECTORS

WEBHOOKS

Subscribe to events from Settings → API. Payloads are JSON, signed with an HMAC-SHA256 header X-Control-Signature.

API

Everything in the dashboard is available over REST at https://api.control.xyz. Authenticate with a scoped API key from Settings: Authorization: Bearer ctl_…

ERRORS & LIMITS

Standard HTTP codes with a JSON body: {"error": {"code", "message"}}. Rate limits: 120 req/min per key (Genesis), 600 req/min (Mainnet+). 429 responses include Retry-After.

API keys are scoped: read, write:risks, write:incidents. Keys inherit the rotation policy — an aged key fails your own KEY ROTATION check.

FAQ