OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Developer Tools

Solana Security Standard

Solana Security Standard is an MIT-licensed collection of SOL-0XX rules for identifying security bug classes in Solana programs. It documents use through a CLI scanner, editor and AI coding-tool workflows, Semgrep, MCP, and GitHub Actions. The README lists 52 bug classes, including missing Anchor constraints and caller-controlled clock values.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Solana Security Standard — OpenViST project profile in Developer Tools.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use it while developing Solana programs when you want checks during coding, a local CLI scan, or a pull-request CI gate using the same rule set.

Who it is for

  • Developers building or maintaining Solana programs.
  • Teams that want security-rule checks in pull-request CI.
  • Developers using supported AI coding tools or editors to surface rule guidance while coding.

Documented uses

  • Scan a Solana programs directory and receive human-readable, JSON or SARIF results.
  • Gate pull requests on rule findings and optionally upload SARIF or add inline annotations.
  • Surface security-rule guidance during coding with a documented Claude Code workflow.
  • Review rule coverage for named bug classes such as missing Anchor constraints and caller-controlled clock values.
Before you choose

Requirements & limits

The repository is public and lists an MIT license.

  • The README describes 52 bug classes and names examples, so teams can assess whether its rule coverage matches their Solana code.
  • The documented CLI supports human, JSON and SARIF output and returns a non-zero exit code when findings are present.
  • The GitHub Actions example supports path selection and optional settings for annotations, SARIF, minimum tier and baseline.
  • The repository documents a release-tag and checksum workflow for supply-chain-sensitive installations; its direct-from-main Claude guidance example has no integrity check.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Add a Solana security scan to GitHub Actions

Run the standard's checks on pull requests and configure the documented scan options.

Before you start

  • A GitHub repository with a workflow file and Solana program code.
  • The GitHub Actions workflow syntax shown in the project README.

Steps

  1. Create a workflow file such as .github/workflows/solana-security.yml.

  2. Add a job that checks out the repository and uses Copenhagen0x/solana-security-standard@v1.

  3. Set the paths input to the code to scan, or use the documented default of the repository root.

  4. Optionally configure security-events permission for inline annotations, SARIF upload, minimum tier or a baseline.

Expected outcome

The action scans the selected path on pull requests; the documented default is to fail on findings and upload SARIF.

Guide limitations

  • The example is specific to GitHub Actions; the README does not specify configuration for other CI systems.
  • Inline annotations require the documented security-events permission; they are optional.
Documentation 1 ↗
Source-based practical guide

Run a local scan with the CLI

Scan a Solana programs directory and choose a supported output format.

Before you start

  • A command-line environment with npx available.
  • A local Solana programs directory to scan.

Steps

  1. Run npx @jelleo/solana-security-standard scan ./programs.

  2. Select human, JSON or SARIF output as needed.

Expected outcome

The CLI reports findings in the selected format and exits non-zero when findings are present.

Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
14 October 2026
Original website title
Copenhagen0x/solana-security-standard · Official homepage title · retained in its source language
How we review sourcesSuggest a correction