DEV SITE — deployed from the dev branch · NOT production · production is falsegreen.com

High-Risk Components

Some code cannot be wrong. Prove it can't.

For control, money, and safety paths, tests sample cases. FalseGreen proves them over all inputs — and returns the exact failing case when a rule breaks.

The problem

The bug only appears in a state developers never ran.

Tests sample, risk hides

A suite explores the cases you thought of. Production fails in the ones you didn't.

unsafe is a promise

The compiler stops where the guarantees stop — and developers never check the promise.

Auditors want proof, not counts

'We have 400 tests' proves nothing about a rule that must hold for every input.

Two proof tools, one verdict

Proven, disproven, or never accepted.

Kani — bounded checks

Explores all inputs up to a bound; a violated rule returns a reproducing counterexample.

Creusot — full proofs

Proves the stated rule for all inputs. No proof — no acceptance; nothing passes silently.

Claims frozen, not fuzzy

The exact formal claim is frozen with the contract and quoted verbatim in the report.

Point it at the risk

Unsafe surfaces, state machines, money paths — where the compiler's guarantees end, FalseGreen's proofs begin.

See how the FalseGreen Job works →

One FalseGreen Job

Freeze the claim
↓
Kani · Creusot decide
↓
PROVEN — report

Requirements in. Verified Rust out.