> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iris.credit/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit reports

> Independent security reviews of the IRIS core contracts.

The IRIS core contracts have been reviewed by two outside firms. Both reports are published in full.

## Guardian, September 2026

Guardian reviewed Iris Protocol over two rounds, a main review and a remediation review, between 27 August and 25 September 2026. The final report is dated 29 September 2026.

| | |
| - | - |
| Scope | The [iris-core](https://github.com/iris-credit/iris-core) contracts |
| Findings | 11 total: no critical, no high, 6 medium, 3 low, 2 informational |
| Outcome | 5 resolved, 6 acknowledged, none left pending |
| Confidence ranking | 4 of 5, which Guardian calls high confidence |

Guardian's scale describes a 4 as code that is clean and well structured, suitable for deployment after remediations, with periodic review as the protocol changes.

[Read the Guardian security review](https://drive.google.com/file/d/1vlhlVSWcgPlLQErwHqyIFvxPGFzA5945/view)

## Hexens, July 2026

Hexens ran a full review of the code over one week in July 2026, led by Jahyun Koo, with the final report dated 17 July 2026.

| | |
| - | - |
| Scope | The [iris-core](https://github.com/iris-credit/iris-core) contracts |
| Findings | 4 total: no critical, no high, no medium, 4 low |
| Outcome | 2 fixed, 2 acknowledged, each verified by Hexens |

Hexens does not publish a confidence score, so there is no equivalent of Guardian's ranking here.

[Read the Hexens security review](https://drive.google.com/file/d/16GnpqSUbVk8-weMpSWnuYFz3-LwdZihy/view)

## What a review does not cover

An audit reviews contract code at a point in time, against the commit the firm was given. It does not cover the lending venues your loan opens on, the oracles those venues price your collateral with, or a solver's own systems.

For the risks that stay with you, see [What you still manage](/home/introduction/overview#what-you-still-manage).