Future Topics

Fix Verification

We recommend verification of fixes by an independent party or the auditors, who performed the audit.

Repeated Audits

A code audit is not a guaranteed proof that a code is safe and secure. Some flaws can be overlooked even by the best auditors. An audit is valid only for a specific “snapshot” of the code. If new code is added or existing code is modified, new vulnerabilities can be introduced. Therefore we recommend to perform audits in regular intervals or integrate audits into release life cycles.

Automated Checks

We recommend to facilitate regular automated checks on all relevant code components, to reduce risk of commonly known misconfigurations or to highlight risky code sections.

Server

The server backend code was only checked with automated tools, which uncovered no direct usage of unsafe code. Logic bugs should be properly investigated and the server component would make a good target for a dedicated audit.

Frontend

The client code base was skimmed but not thoroughly audited, instances of dangerouslySetInnerHTML showed simple to detect vulnerabilities but more hidden potentially security relevant bugs should be further investigated in a dedicated audit.