This is also something we are aware and know that there is room for improvement. 4.3 (Low) IP blocking can be circumvented We are aware that this could be improved and have been working towards a better long-term solution based on storing credentials with a more suitable secrets management tool.

These services run on dedicated hardware with full disk encryption so we feel that these credentials are adequately protected. 3.3 (Note) Secrets in docker-compose.yml and environment variables We will follow their recommendation to add server TLS for connections to Redis. 3.1 (Low) Unencrypted network traffic to RedisĪs the description of the issue points out, the traffic is encrypted on the network layer but the auditors were right to point out that encryption on the application layer would be a good addition. A few issues require a larger redesign however but we consider them low risk enough that we decided to publish the report. Most issues were patched while the report was being finished and were noted as such in the final version.

Read the full audit report on Assured’s website. No critical, high or medium rated issues were identified during the penetration test and the overall security of the API is deemed good. Remove the '' in the URL or check the Mullvad Blog directly.)Īssured AB were contracted to perform a security assessment of our account and payment services between -29. From: httpsmullvadnet/en/blog/7/security-audit-of-account-and-payment-services/ (Mullvad domain is blacklisted on reddit, making post invisible to everyone until a moderator take care of it.

Reddit mullvad