What's new in Nacodex

27 October 2026

We ran a Nacodex audit on the Nacodex Service itself: the backend, the audit system and the Android app. Every finding was checked again against the code. These fixes are now live on the Service:

• Sign-in: wallet sign-in accepts only the full signed sign-in message.
• Your data: the automatic clean-up after an order now also deletes the session records an audit leaves on our servers, together with your code and its working copy.
• Payments: the Service checks each payment more strictly before it counts it.
• Consultant: more safeguards around consultant keys, questions and credit.

The fixes for the Android app come with its next update.

On 21 October 2026 Solana Mobile launched Seeker Connect, its own named connection to the Seeker wallet. On a Seeker with Seeker Wallet, Nacodex 1.1.6 signs you in with Seeker Wallet through Seeker Connect. You still approve in Seeker Wallet as before.

Seeker Connect is used for sign-in only. Your payments keep going through your wallet as before. More from Solana Mobile on X.

Nacodex 1.1.6 is now the download on this site. Before your wallet sends a payment, the app checks that the transaction matches the payment it prepared for you (the wallet may only add its usual fee and safety instructions) and stops anything else before it is sent.

• Tested with real SOL payments on the released app, one each from Solflare and Seeker Wallet.
• Not open yet in the app: payments from Phantom and Backpack, and payments in USDC or SKR. The app stops them before anything is sent.
• To pay now, use Solflare or Seeker Wallet with SOL, or write to support@nacodex.help.

Download the latest version from the home page.

24 October 2026

In May 2026 we audited the Jupiter developer documentation and found 21 issues. On 11 October we checked the same pages again, and on 24 October we dated each change against Jupiter's public documentation history.

• Six of the 21 findings were changed by Jupiter after our copy of 28 May: five fixed, one partly fixed. Three are dated to the day: the portal address on 8 June, the Ultra pricing rows on 22 June, the transaction endpoint on 29 July.
• The rest: 13 were unchanged on 11 October, one could not be judged, and one (Trigger v1 and v2) cannot be placed after our audit, because Jupiter's public documentation source already pointed that page at v2 in March.
• Against our recommendations: some changes follow them closely, some take a different route. We were wrong on two details, which our revised report had already corrected.

This shows that our findings pointed at text Jupiter later changed. It does not show why Jupiter changed it, and findings that are unchanged are not disproved. Read the comparison.

Node.js and PHP both published security releases recently. The first question everyone asked was "are we affected?". Most teams could not answer quickly, because nobody had a list of which runtime versions their product actually runs or ships.

Every Nacodex audit that includes Security, and every Full audit, now checks this for you.

• It lists the language runtimes your code pins or ships: container base images, CI and build images, version files, engine settings in your manifests, and runtimes bundled into what you ship.
• It compares each one with that runtime line's end-of-life date and latest release, from a public release tracker, dated in the report. A line past end of life is flagged. A version behind its line's latest patch is marked "patch behind, security state unread": the audit does not read each vendor's security advisories, so it points you to them.
• For each finding it gives the target version and where to change it (rebuild the image, bump the pin), and the one command that confirms what is really running on your servers: an audit of your code sees what you pinned, not what you deployed.

Node.js, PHP, Python, Ruby, Go, .NET, Java, Deno and Bun are covered.

Big codebases used to be quoted by hand. Now you order them on this site like any other audit, and in the app from Nacodex 1.1.

• Whole-product audits up to 20 MB of code, reviewed task by task. Every result is saved the moment it is made, and a long audit pauses and continues instead of starting over.
• Deep audits of your core, up to 3 MB, for what matters most: security, money, accounts, data safety and architecture.
• Priced from our own test runs of the method. The price follows the areas you choose, so you pay for what you order.
• Large and Deep audits, and Standard audits of more than 1 MB of code, are started by hand after payment, usually within a day. The audit itself then takes several hours (a large Deep one up to about a day).

We proved the method on a real 20 MB product with over 1,200 files before offering it to you.

Audit prices now follow what you order. Each area you add is priced, so a single-area audit of a large codebase costs less than a full one, and the price no longer jumps at size limits.

New guidance since our last update:

• AI assistants that answer customers: a check at every step, and a screen before any charge
• servers that come back after a restart, with a second process answering
• apps that can be adjusted from the server while keeping a firm core
• swapping a platform resource without dropping the working one
• finishing a flow on the device where it actually runs
• getting back into an account after deleting or resetting it, the way a real person would
• fixing a security finding without weakening the protection it found missing
• "make it smoother" requests that must keep the step that proves who you are
• handing a sign-in from one device to another safely
• de-duplication that quietly hides results in tests and monitors
• layout changes made at the wrong moment that make screens flicker or lose updates
• release checks that test the fixed core of an app, while settings served from the server are checked when they are published

The Nacodex app shows the current version under Profile, About.

Found an architectural failure the hard way? The Contribution Guide v3.5 walks your AI assistant through turning a working session into a contribution. A lesson that becomes a Nacodex rule earns $Nacodex when it is added, and again whenever it helps find issues in paid audits.

• the Consultant tab
• the Nacodex version under About, linked to this page
• Large and Deep ordering
• clearer notifications

Update from Profile in the app, or download the latest version from the home page.