For Protocol Founders

Treat security as launch operations: owners, evidence, signoff criteria, emergency response, and continuous monitoring. Audits matter, but they are not a substitute for accountable launch gates.

30 / 60 / 90-day path

Window	What to do	Evidence to keep
30 days	Name owners for contracts, frontend, DNS, multisig, oracle, bridge, comms, and incident command.	Owner matrix, risk register, launch scope, audit package plan.
60 days	Run pre-audit, frontend, supply-chain, multisig, oracle, and launch readiness gates.	Gate results, open risk decisions, rehearsal notes, signer policy.
90 days	Move from launch readiness to monitoring, bounty triage, signer review, and quarterly risk review.	Monitoring dashboard, accepted-risk expiry dates, post-launch review.

Must-read pages

• Launch readiness
• Security program maturity
• Multisig and governance
• Incident war room

Checklists to use first

• Protocol launch readiness
• Bug bounty readiness
• Multisig and governance

First 10 resources

1. OpenZeppelin Readiness Guide
2. OWASP SCSVS
3. SEAL Frameworks
4. Safe Help Center
5. Safe Transaction Service
6. Chainlink feed selection docs
7. Wormhole security
8. Tenderly docs
9. DefiLlama hacks
10. DigiBastion Threat Intel

Common failure

Founders often treat audit completion as launch approval. Better launch decisions come from a package: scope, tests, audit fixes, privileged-role controls, frontend posture, dependency posture, incident runbooks, and accepted-risk owners.