Colin

Fractional Security Engineer @daybreaksc
Auditor - @SecurityOak
Audit History -

[Colin @contracthaxor]

Launching Daybreak Solana, an open source multi-agent security auditor for Solana programs.

https://t.co/6UkeWX6x1y

Security reviews should be part of the development lifecycle early and often, not a single checkpoint at the end. Daybreak is not meant to replace auditing firms. Its purpose is to help developers without a dedicated security focus scan their repos frequently, learn from the findings iteratively, and show up to their audit with a much higher quality codebase.

Daybreak Solana allows auditors to spend their expensive time where it actually matters, on high impact and unique issues that require human expertise, instead of burning cycles on common bug classes a tool can catch the day they get written.

We reviewed hundreds of Solana audit reports from across the ecosystem and clustered the real findings into a small set of high level bug classes. Each class becomes a dedicated agent with a tight, focused context window. Instead of one generalist model trying to hold every vulnerability pattern in its head at once, each agent hunts for a specific family of bugs it knows deeply. Smaller context, sharper signal, fewer misses.

Most AI security tools dump a wall of text, Daybreak gives you a real triage UI. Click through findings, see flagged lines, dismiss false positives, escalate what matters, export as PDF or Markdown.
https://t.co/yaQBVZDJIT - work with us!

@daybreaksc

[Colin @contracthaxor]

hey David, what do you think about Santamadre Unusual Nitrous? Have any of your athletes tried it? Im curious what you think about the fact that it isn't hydrogel. I took it over the weekend just to try it and load sodium for a 13h run on Nolans and it went fine but im just curious about the efficacy compared to maurten.

[Colin @contracthaxor]

@Brady_H used woodways are a better value

[Colin @contracthaxor]

@ThePapaLinks the real question is how can someone "walk" a 3h marathon

[Colin @contracthaxor]

@HankFrank Salida or Buena vista Colorado. Best access to the highest density of 14ers and great trails.

[SafeDep @safedepio]

🚨 The "𝙼𝚎𝚐𝚊𝚕𝚘𝚍𝚘𝚗" Campaign is live...

𝟻,𝟽𝟷𝟾 malicious commits to 𝟻,𝟻𝟼𝟷 GitHub repositories in a six-hour window.

Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected 𝙶𝚒𝚝𝙷𝚞𝚋 𝙰𝚌𝚝𝚒𝚘𝚗𝚜 workflows containing 𝚋𝚊𝚜𝚎𝟼𝟺-𝚎𝚗𝚌𝚘𝚍𝚎𝚍 bash payloads that exfiltrate:

- CI secrets,
- cloud credentials
- SSH keys
- OIDC tokens
- source code secrets

Check your repo / Technical details: https://t.co/tua3jYU1wa

[Colin @contracthaxor]

@JoePostingg guy has bigger fish to fry

[Colin @contracthaxor]

@DavidDack All of them are cooked

[Colin @contracthaxor]

@HankFrank @samanthajmarin looks familiar..

[Colin @contracthaxor]

@Brady_H @MarathonHB @SageCanaday Truett next?

[Colin @contracthaxor]

@taggartvanetten @Brady_H @MarathonHB All these influencers are taking questionable if not outright illegal stuff. I’m seeing first hand through an athlete im coaching how much it gets In their head when they are doing everything right and then an influencer in their first marathon runs something in the 2:30s

[Colin @contracthaxor]

@Brady_H @MarathonHB Many such cases

[Colin @contracthaxor]

@taggartvanetten Best shoe I’ve ever owned. I can run full on marathon pace in these they feel like an alphafly with a way more comfy upper. Obviously heavier but the midsole is even better

[Colin @contracthaxor]

@yacineMTB ragebait. The only hope we have from a security perspective is dedicated remote dev environments.

[Colin @contracthaxor]

@Brady_H Boston is pretty good a least! I think most of this comes down to gps data tho, maybe during the last couple of miles downtown. It wonder how much different the data would be if you were wearing a stryd or other foot pod

[Colin @contracthaxor]

@0xgaut Depends on how fast you’re running..

[Andras Bacsai @heyandras]

We made a fake repo with fake bounties, and the bots are applying fake PRs, so we know who is fake, and we can ban them from the Coolify repo.

IQ over 1000

[Colin @contracthaxor]

@jeffsecurity totally agree, what do you think it will take for the market to understand post-audit security? Right now it feels like a really hard sell.

[Colin @contracthaxor]

I originally misread this as "audit team".

Good auditors and teams should definitely be rewarded for their unique skills. So in theory as much as the market will pay them. In reality what I've seen is 10-20k for a top auditor.

What my original comment meant to say is that the actual cost and scope duration should be decreasing for the same scope LOC. Most of the tedious low-leverage audit tasks are much more streamlined these days.

The highest leverage for the industry is freeing up S-tier auditors to cover more projects by offloading the work where their judgment isn't the differentiator.

[Colin @contracthaxor]

10 miler and 50 miler should be the gold standard ;) I think broad street this year was awesome. 50 on the trails is awesome because it can be 6 hours and flat or it can be 15 hours with 23k climbing like the Ouray 50. I think 50 is coming back in style because it can be super dynamic and raced multiple times in a year