3 key things:

<aside> <img src="/icons/lock_purple.svg" alt="/icons/lock_purple.svg" width="40px" /> Privacy settings for audit findings:

For most audits, authenticated C4 wardens have visibility on submissions after close. This allows our active warden community to see how their submissions are judged, and learn from experience.
Exception: if your audit included live code, then your submissions stay private until the report is published, at which point they will be made public (unless you requested otherwise).

</aside>

Best, not first: Judges prioritize the best quality submission of a finding, not the earliest one.

</aside>

<aside> <img src="/icons/copy_purple.svg" alt="/icons/copy_purple.svg" width="40px" /> Expect to see duplicates: C4 wardens seek unique, high-risk vulnerabilities. They can't view others' findings beforehand — so it’s typical to see duplicate submissions.

</aside>

Timeline

Timeline (est.)	Phase	Details
Day 1	Preview findings	Your team has immediate access to triaged submissions.
Days 1-3	Triage	The judge reviews any last-minute submissions and forward satisfactory issues to you for review.
Days 4-10	Review	Project team reviews each unique issue, adding labels (confirm/dispute/acknowledge) and comments for the judge’s consideration. More details 👇
	Judging	Judge reviews all submissions, and your input.
	Mitigations	Most projects begin mitigating findings at this stage, but timing is up to you. If you opted for a C4 mitigation review, read on 👇
Days 11+	Post-judging QA	48h “QA” phase when your team (and qualified wardens) can review the judge’s preliminary verdicts, and raise questions or concerns. How it works 👇
	Finalization	Judge finalizes decisions
	Awarding	Once judging decisions are final, C4 distributes awards to wardens, judge, and validators.
	Mitigation review (optional)	If you’ve opted for a mitigation review, it can usually begin a few days after your audit judging is complete and validated. (If you haven’t already booked a mitigation review, reach out to C4 staff and we can share more info.)
Day 21-28	Draft report delivered	C4 staff draft your audit report and share it with you for approval before publication.
Day 28	Report published	Once you approve the report, and confirm that mitigations are complete, we’ll publish your report and make the findings public, if not already.

Timelines vary depending on number of submissions, complexity of codebase, etc.

Review your findings

<aside> <img src="/icons/command-line_purple.svg" alt="/icons/command-line_purple.svg" width="40px" /> Your in-app dashboard will guide you through the review process.

</aside>

Post-judging QA

After initial judging is complete, there is a 48-hour period during which you can share any final comments, questions, or concerns that should be addressed before your report is written.

During this phase, Code4rena’s Certified Security Researchers also do a round of QA on the judge’s decisions.
This “swarm” approach to QA is a key element of why C4’s judging is so widely respected. Often, the Security Researchers will identify overlooked duplicates, open discussions about validity and/or risk, and generally ensure your audit submissions have been reviewed with a fine-toothed comb.

Mitigating issues

It's up to you what you choose to mitigate; just let us know when you're done. If there are issues you acknowledge but don't plan to patch, it's helpful if you can label them accordingly (e.g. as sponsor acknowledged).
If you are planning a Code4rena mitigation review: everything you need to know is outlined in Mitigation reviews: sponsor guidelines.
If you aren’t planning a mitigation review: you may opt to link to your C4 findings if you find it helpful.

Hey, congratulations! And thank you. Getting an audit is courageous. We think you’re awesome. 💜