Self-conducted security testing #
This is first-party testing. It is performed by the operator, not by an independent assessor, and it does not substitute for the independent external penetration test recorded as absent on Trust . It is published because the substance is useful to a reviewer even where the independence is missing.
Last updated: 2026-09-05.
Testing performed #
| Date | Type | Scope | Outcome |
|---|---|---|---|
| 2026-05-26 | Code-level security assessment | Static analysis, dependency audit, and manual review of authentication, authorization, and file handling | Upload handling identified as the highest-risk area. Findings tracked in the issue tracker and remediated: server-side attachment-count limits, direct-upload authorization, and parameter and IP scrubbing in logs |
| 2026-05-26 | External production test, non-destructive | Response headers, TLS configuration, public pages, and metadata probes against the production host | Response-header coverage gaps and missing security-contact metadata; reliance on third-party asset CDNs assessed as medium risk. Remediated 2026-05-27: security-contact metadata published, content-type sniffing protection extended to static assets |
| 2026-06-09 | Authentication review | Cookie handling, session lifecycle, magic-link and invitation flows | Two informational findings. Remediated 2026-06-14: the pending-authentication cookie moved to an encrypted store so the address is not readable client-side; the session cookie’s stated expiry now matches the 14-day server-side idle timeout |
| 2026-08-27 | Authenticated graybox test | Cross-tenant access, privilege escalation, mass assignment, within-tenant report access, attachment confidentiality, SCIM isolation, SAML assertion trust | No authorization defects found. Tenant and role boundaries held in every case tested |
| 2026-08-27 | Production exposure review | Network exposure, host hardening, proxy header handling, secret handling | Client-supplied forwarding headers were trusted on a directly internet-facing origin, which would have allowed the per-IP rate limits to be bypassed. Fixed the same day. A per-request server-timing header was also removed. The superseded Feature-Policy header was replaced with Permissions-Policy on 2026-09-05 |
Known open findings #
| Finding | Position |
|---|---|
| No web application firewall or CDN in front of the application origin | Deliberate. Direct application and file hosting is in the EU, while the email and telemetry chain may involve downstream processing outside the EEA. Network-level DDoS protection at the hosting provider plus application-layer rate limiting is the current trade-off. |
What this does not establish #
- The operator chose the scope, ran the tests, and reported the results. Nothing here has been independently verified.
- A pass with no findings is evidence about the cases tested, not about the cases that were not tested.
- Control A.5.35 of the ISO/IEC 27001:2022 Annex A control map — independent review of information security — remains open for this reason. It is the only control on that page recorded as in treatment.
Last updated: