Security and audits
Do not use this with real value. Not yet.
Where things stand
An internal, AI-assisted security review of both the station and the mobile app was completed in August 2026. It found no High-severity issues, with a handful of Medium and Low findings concentrated at the pairing and recovery ceremony surfaces and at platform exposure on the phone (clipboard, screen capture, keychain accessibility). The full reports, with each finding’s failure scenario and remediation order, are public:
That review was a code review performed by an AI model operated by the maintainer. It is not a penetration test and not an attestation by a professional security firm. It was meant to raise the floor, not to clear the stack for production. An independent professional audit remains warranted before any deployment where real people depend on this software, and it has not happened yet.
The threat model
The project keeps a living, STRIDE-organized threat model that grows with each component and states plainly what is not mitigated:
Some limitations worth knowing as a user:
- A compromised phone or station OS is out of scope. The software defends the wire and the disk; it cannot defend against a machine that is already someone else’s.
- Radio and SMS leak metadata. They carry only signed, public records, but a radio has a location and a phone number has an owner. Communities under surveillance pressure should prefer paper for sensitive traffic.
- Offline double-spending cannot be prevented, only priced. See When the network is down.
- Nothing rate-limits a paired member. Every input is size-bounded, but no surface limits how often one identity may call it. At pilot scale the pairing gate is the accepted bound.
- The encrypted at-rest profile defends a powered-off station only. A station seized while running has its keys in memory. See Encrypted at rest.
- A read replica is a copy of the history, not a second source of balances. Its derived views are empty by design, loudly.
Reporting a vulnerability
Please do not open a public issue for a security problem. See the
security policy
in the station repo for how to reach the maintainers privately.