Greetings from the Celo Foundation Community Security Team! 
We’re here to improve security within the Celo Ecosystem.
This post is in regards to Security Reviews & Celo Foundation Support. Every Partner must apply for and undergo a security review, unless exempt, in order to qualify for any level of support. The level of support depends on the size of the project and the proof of security provided. Although the Celo Foundation would like to support every project in the ecosystem, the Celo Foundation cannot guarantee support even if all requirements are met and all support is on a case-by-case basis.
Overview of the Tiers w/ Support
Tier 1
Project Type: Large, established ecosystem projects.
Support: Opportunity for formal partnership. Co-marketing promotion(s) from the Celo Foundation. Grants to accelerate ecosystem adoption.
Requirements: Extensive security audits. Community trust established. Mature development practices. No recent security breaches.
Tier 2
Project Type: Small to medium-sized organizations with quantifiable growth.
Support: Grants as deemed appropriate by the Celo Foundation. Marketing support from the Celo Foundation pre-launch, at launch, and/or at other important times.
Requirements: Security audit(s) performed on all solidity code, e.g. smart contracts. No connection to past breaches or organizations with a failing reputation. Active community management via telegram, discord, etc.
Tier 3
Project Type: Newly formed, or early stages of growth.
Support: Grants and promotion on Celo Foundation channels. Onboarding into the Celo ecosystem with access to the resources of the network.
Requirements: Audit in progress, or proof of contract security. If a fork, perform due diligence, to ensure no reused naming conventions within the codebase, unless necessary. Commitment to providing a secure environment and championing security matters, and bolstering the DeFi community.
Security Review Checks
Tier 3:
- SSH (Secure Shell Protocol) and other management methods are controlled by access list.
- Unneeded files are not hosted on the public website.
- Pre-made and/or “forked” naming conventions from other projects should not exist, unless specifically necessary.
- Implemented Denial of Service protections.
- Implemented redundancy of critical infrastructure.
- All encryption ciphers are up to date, and valid TLS certificates.
- VPN, Firewall, and network segmentation usage as necessary.
- Infrastructure with a positive security reputation is used.
- Willing to discuss industry best practices with partners.
- Lessons learned from audits are applied.
- All public-facing infrastructure has the latest security patches.
Tier 2 (Everything from Tier 3 plus):
- Separated and Restricted Development Environment.
- A security review of cloud permissions has been performed.
- No connection to any past exploited protocol or fraud.
- Active helpdesk/community management to provide assistance to newer users and others who have questions via telegram, discord, etc.
- Real-world identities of individuals are known to trusted partners.
- Proper implementation and appropriate scope of multi-sig technologies.
- Changes are reviewed for accuracy and completeness before being implemented.
- Security Audit Reports are available for all smart contracts and solidity code in production
Tier 1 (Everything from Tier 3 and Tier 2 plus):
- No egregious demerits on record of ‘staff’ or any custodian used.
- No security incidents in the past 6 months, and no moderate to major incidents in the past year.
- Controlled software development process.
- Willingness to meet quarterly or as often as needed to discuss the security posture of the protocol, and Celo’s terms.
- Front-end security is accounted for and have, or will have, a penetration test conducted from a reputable 3rd party.
- Security Vetting or background checks are performed on personnel.
- Reputable auditor(s) used, and ongoing assessments/audits of smart contract changes that are made. (e.g. agreement/relationship with an auditor to audit any moderate or major changes to the platform)
- Process for handling vulnerabilities/incident response mechanisms in place to address potential major security incidents.
- History of reduction in a number of critical vulnerabilities.
- If code is forked from another protocol; the organization should be able to explain the ‘patches’ taken if there was a vulnerability found in the original fork.
- OpenZeppelin or other contract templates are used in their entirety, or as a base.
- Any DAO is associated with a legal entity.
- No personal or unidentified addresses used in smart contract calls, and Ownership either revoked or managed with tight multi-sig and/or locker security (e.g. Gnosis Safe).
Process for requesting a Security Review 
To request a security (smart contract) audit, the prospective DeFi Partner can contact and furthermore work closely with the Community Security team. Help in acquiring and finalizing a security audit can not be guaranteed for all partners, as there is a significant bottleneck in smart contract auditors– creating huge delays and price spikes. The Community Security team is also helping partners obtain expert quality web-application penetration tests, in order to ensure the community is able to have peace-of-mind when entrusting their digital assets to Celo ecosystem partners.
Please feel free to reach out to the team to initiate the security review process. 