> Scope, dates, findings, and remediation for the security testing EthicsPortal performs on itself. First-party testing, not an independent audit.

Source: https://ethicsportal.eu/security-testing/
Updated: 2026-09-23

---

# Self-conducted security testing

**This is first-party testing.** It is performed by the operator, not by an independent assessor, and it does not substitute for the independent external penetration test recorded as absent on [Trust](/trust/#certification-status). It is published because the substance is useful to a reviewer even where the independence is missing.

Last updated: 2026-09-05.

---

## Testing performed

| Date | Type | Scope | Outcome |
|---|---|---|---|
| 2026-05-26 | Code-level security assessment | Static analysis, dependency audit, and manual review of authentication, authorization, and file handling | Upload handling identified as the highest-risk area. Findings tracked in the issue tracker and remediated: server-side attachment-count limits, direct-upload authorization, and parameter and IP scrubbing in logs |
| 2026-05-26 | External production test, non-destructive | Response headers, TLS configuration, public pages, and metadata probes against the production host | Response-header coverage gaps and missing security-contact metadata; reliance on third-party asset CDNs assessed as medium risk. Remediated 2026-05-27: security-contact metadata published, content-type sniffing protection extended to static assets |
| 2026-06-09 | Authentication review | Cookie handling, session lifecycle, magic-link and invitation flows | Two informational findings. Remediated 2026-06-14: the pending-authentication cookie moved to an encrypted store so the address is not readable client-side; the session cookie's stated expiry now matches the 14-day server-side idle timeout |
| 2026-08-27 | Authenticated graybox test | Cross-tenant access, privilege escalation, mass assignment, within-tenant report access, attachment confidentiality, SCIM isolation, SAML assertion trust | No authorization defects found. Tenant and role boundaries held in every case tested |
| 2026-08-27 | Production exposure review | Network exposure, host hardening, proxy header handling, secret handling | Client-supplied forwarding headers were trusted on a directly internet-facing origin, which would have allowed the per-IP rate limits to be bypassed. Fixed the same day. A per-request server-timing header was also removed. The superseded `Feature-Policy` header was replaced with `Permissions-Policy` on 2026-09-05 |

## Known open findings

| Finding | Position |
|---|---|
| No web application firewall or CDN in front of the application origin | Deliberate. Direct application and file hosting is in the EU, while the email and telemetry chain may involve downstream processing outside the EEA. Network-level DDoS protection at the hosting provider plus application-layer rate limiting is the current trade-off. |

## What this does not establish

- The operator chose the scope, ran the tests, and reported the results. Nothing here has been independently verified.
- A pass with no findings is evidence about the cases tested, not about the cases that were not tested.
- Control A.5.35 of the [ISO/IEC 27001:2022 Annex A control map](/iso-27001/) --- independent review of information security --- remains open for this reason. It is the only control on that page recorded as in treatment.