Overview

Thirdpass coordinates security review for important software.

The core idea is that review evidence should be reusable. A review submitted for an exact artifact, release, or security-relevant code path can help every project and ecosystem that relies on the same software, instead of forcing each project to repeat the work alone.

What Thirdpass Does

Thirdpass has three main parts:

• A CLI that runs reviews and checks projects from the terminal.
• Ecosystem extensions that understand package registries and dependency files.
• A server that assigns review work through campaigns and stores submitted review evidence.

Main Workflows

Use campaign list to discover review missions:

thirdpass campaign list

Use review-any to contribute to the bitcoin-only campaign:

thirdpass review-any --campaign bitcoin-only

The default review-all-oss campaign is the broad server-selected review pool:

thirdpass review-any --nightshift

Use review-deps inside a project to review packages your project already depends on. Completed reviews are saved in the project under .thirdpass/reviews/ so they can be committed with the dependency files:

thirdpass review-deps

Use check inside a project to compare its dependencies against submitted reviews and committed project reviews:

thirdpass check

Why Review State Matters

Thirdpass reviews are file-focused. A package may have many files, and review coverage grows as more files are reviewed.

This makes review state visible instead of binary. A package, release delta, or campaign target can be partly reviewed, fully reviewed, stale after a relevant change, or reviewed several times by independent contributors.