CounterProof reviewed a Bitcoin infrastructure codebase at a pinned revision, using deterministic reproductions against unmodified code. Candidate claims were separated into reproduced behavior, source-only analysis, and refuted hypotheses. Where maintainers supplied better evidence, CounterProof corrected or withdrew claims. The objective was not to maximize a finding count, but to make every surviving conclusion easier to verify.
What this shows
The useful unit of a security report is not a finding count. It is a claim whose evidence level a maintainer can inspect. Some claims can be settled by execution. Some remain source-supported. Some fail under testing or during triage. A report that says which is which is easier to act on than one that defends every candidate.
Limits
This page is anonymized because the underlying project details are private. It describes the working method, not the system examined, the findings, or the current remediation state. It is not a claim that the review was comprehensive, that every candidate was confirmed, or that the reviewed system is safe.