web/.cursor/commands/security-audit.md

Security Audit Command

Perform a comprehensive security audit of the FromChat Android application only.

Project Context

FromChat Android is a 100% open source secure messaging mobile application built with:

• Kotlin Multiplatform (KMP) shared code
• Jetpack Compose UI framework
• End-to-End Encryption (NaCl, AES-GCM)
• WebSocket support for real-time features
• LiveKit integration for calls
• Local database storage (SQLite)

Scope: Android Only

OUT OF SCOPE:

• Web backend (Python FastAPI, Caddy infrastructure)
• React/TypeScript frontend

IN SCOPE:

• Android app code (app/android, app/shared/src/androidMain)
• Shared cross-platform code (app/shared/src/commonMain)
• Local encryption implementation (NaCl, AES-GCM)
• Secure storage (Android Keystore, encrypted SharedPreferences)
• WebSocket client security
• Permission usage and handling
• Call security (LiveKit integration)
• Memory safety and injection attacks
• Backend

Important Design Decisions (NOT Vulnerabilities)

When auditing, remember these are intentional design choices:

1. Local message caching - Messages downloaded and stored locally (by design)

• Messages are end-to-end encrypted at rest in local DB
• Public DMs are not encrypted (messages are public)
• Private DMs use NaCl encryption
• Cache persists across app restarts for offline access

2. Local key storage - Encryption keys stored on device (by design)

• Keys protected by Android Keystore (hardware-backed when available)
• Encrypted with device-specific secrets
• User data never leaves device in plaintext
• Do NOT flag key storage as critical (Keystore is production-ready)

Output Format

Provide a clean, concise report with:

1. Executive Summary - Overall rating and production readiness
2. Security Status - Critical issues (if any) and recommendations
3. Security Strengths - What's done well
4. Component Ratings - Table format for quick reference
5. Architecture Review - Data flow, encryption boundaries
6. Threat Analysis - Current realistic threats (e.g., rooted device, malicious APK)
7. Recommendations - Prioritized with time estimates
8. Conclusion - Clear production readiness statement

Keep it under 500 lines - focus on actionable findings, not verbose explanations.

Common False Positives to Avoid

❌ DO NOT FLAG THESE AS ISSUES:

• Local message caching (intentional for offline access)
• Public message viewing without auth (intentional design)
• Debuggable APK (only relevant if signed/released)