Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Security and audits

Do not use this with real value. Not yet.

Where things stand

An internal, AI-assisted security review of both the station and the mobile app was completed in August 2026. It found no High-severity issues, with a handful of Medium and Low findings concentrated at the pairing and recovery ceremony surfaces and at platform exposure on the phone (clipboard, screen capture, keychain accessibility). The full reports, with each finding’s failure scenario and remediation order, are public:

That review was a code review performed by an AI model operated by the maintainer. It is not a penetration test and not an attestation by a professional security firm. It was meant to raise the floor, not to clear the stack for production. An independent professional audit remains warranted before any deployment where real people depend on this software, and it has not happened yet.

The threat model

The project keeps a living, STRIDE-organized threat model that grows with each component and states plainly what is not mitigated:

Some limitations worth knowing as a user:

  • A compromised phone or station OS is out of scope. The software defends the wire and the disk; it cannot defend against a machine that is already someone else’s.
  • Radio and SMS leak metadata. They carry only signed, public records, but a radio has a location and a phone number has an owner. Communities under surveillance pressure should prefer paper for sensitive traffic.
  • Offline double-spending cannot be prevented, only priced. See When the network is down.
  • Nothing rate-limits a paired member. Every input is size-bounded, but no surface limits how often one identity may call it. At pilot scale the pairing gate is the accepted bound.
  • The encrypted at-rest profile defends a powered-off station only. A station seized while running has its keys in memory. See Encrypted at rest.
  • A read replica is a copy of the history, not a second source of balances. Its derived views are empty by design, loudly.

Reporting a vulnerability

Please do not open a public issue for a security problem. See the security policy in the station repo for how to reach the maintainers privately.