The Security Layer pillar. ForgeGATE runs the audit queue, threat intelligence, and a verifiable certificate registry that grades and attests project safety.
Live application state and user actions are enforced by the Express service and its PostgreSQL database. The Solidity contracts deployed to Sepolia are reference implementations, not the live runtime execution path.
Projects submit contract identifiers and code hashes to ForgeGATE for security review. Each submission enters a structured audit queue and advances through automated workflow triage before trusted manual review. The automated engine does not analyze bytecode, assign findings, or grant a verdict. Trusted admins supply the reviewed score, grade, findings, and final status through a signed approval flow.
Successfully reviewed projects can receive a certificate record with a certificate hash stored in the application registry. Public records show the project name, contract address, supported grade (S, A, B, C, or F), certificate hash, and issuance timestamp. Certificates are issued only by trusted admins through a signed approval flow — automated triage results alone do not grant a certificate. The ForgeGATE page can match a supplied certificate hash against the currently loaded public registry.
ForgeGATE publishes the threat records currently stored in the application database. The public feed surfaces operator-recorded vulnerability and attack-vector notices. The current automated audit workflow does not claim to ingest external research automatically or cross-reference submissions against the threat feed.