AUDIT · Cure53 · 2025
What they found.
A 17-day independent audit of tunnel, identity, and the customer portal. Full report PDF, no redactions, hash published.
◆
Scope.
Tunnel protocol
WireGuard wire format + multi-proto muxer
Identity service
Burner email + phone + card flow
Account portal
Web auth, billing, data export
17
DAYS ON AUDIT
4 · Cure53 Berlin
ENGINEERS
5
TOTAL FINDINGS
5 DAYS
MEDIAN FIX TIME
◆
Findings.
All of them, including anything still open.
BAY-25-001
Tunnel handshake nonce reuse under packet-loss recovery
High
fixed · 2025-09-12 · v2.3.4
BAY-25-004
Marketing site reflected XSS via legacy /utm endpoint
Low
fixed · 2025-09-19 · same day
BAY-25-005
Apple TV · username visible in log on debug build
Low
fixed · 2025-09-19 · same day
BAY-25-006
API · server header discloses build hash in error path
Low
fixed · 2025-09-22 · v2.3.5
BAY-25-007
Hardening recommendation: drop CAP_NET_ADMIN post-bind
Info
accepted · 2025-10-04 · v2.3.6
Full PDF · 84 pages
Cure53 letterhead, original findings, our response written inline. · 4.2 MB
SHA-256 · 4d0b a81f 91e2 c755 7ff6 220a c188 33ee 88af 4019 0bdc 12e2 4711 50aa 9988 38af
Previous audit
2024 audit · Trail of Bits
The audit before this one — tunnel only. 6 findings, all closed.