generated: '2026-07-19'
method: searched
probe: false
source: https://docs.huma.finance/ecosystem-resources/security-audits.md
policy:
  - https://cantina.xyz/
disclosure_page: https://docs.huma.finance/ecosystem-resources/security-audits
bug_bounty:
  program: Spearbit/Cantina
  url: https://cantina.xyz/
security_audits:
  - firm: Halborn
    scope: Solana programs (Huma 2.0, Huma Institutional)
    report: https://www.halborn.com/audits/huma-finance/solana-programs-060022
  - firm: Sec3
    scope: Solana programs (Huma Prime / permissionless vault)
    report: https://github.com/sec3-service/reports/blob/master/reports/sec3_huma_vault.pdf
  - firm: Spearbit
    scope: EVM smart contracts
    report: https://github.com/00labs/huma-contracts-v2/blob/develop/audit/spearbit.pdf
  - firm: Certora
    scope: Stellar (Soroban) contracts
    report: https://certora.cdn.prismic.io/certora/Z0dE1pbqstJ971DG_HumaCertoraAuditReport.pdf
evidence:
  - source: https://docs.huma.finance/ecosystem-resources/security-audits
    kind: security-audits-page
    keywords: [bug bounty, Spearbit, Cantina, penetration testing, multisig, audit]
notes: >-
  Huma publishes a Security & Audits page documenting multisig-gated admin
  rights, third-party smart-contract audits (Halborn, Sec3, Spearbit, Certora),
  backend penetration testing, and an active bug-bounty program run with
  Spearbit/Cantina. No formal enterprise certifications (SOC 2 / ISO 27001 /
  PCI) are published, so no Compliance/TrustCenter claim is asserted here.