mirror of
https://github.com/fromchat-messenger/web.git
synced 2026-09-22 19:15:08 +03:00
73 lines
2.5 KiB
Markdown
73 lines
2.5 KiB
Markdown
# Security Audit Command
|
|
|
|
Perform a comprehensive security audit of the FromChat **Android application** only.
|
|
|
|
## Project Context
|
|
|
|
**FromChat Android** is a 100% open source secure messaging mobile application built with:
|
|
|
|
- Kotlin Multiplatform (KMP) shared code
|
|
- Jetpack Compose UI framework
|
|
- End-to-End Encryption (NaCl, AES-GCM)
|
|
- WebSocket support for real-time features
|
|
- LiveKit integration for calls
|
|
- Local database storage (SQLite)
|
|
|
|
## Scope: Android Only
|
|
|
|
**OUT OF SCOPE:**
|
|
|
|
- Web backend (Python FastAPI, Caddy infrastructure)
|
|
- React/TypeScript frontend
|
|
|
|
**IN SCOPE:**
|
|
|
|
- Android app code (`app/android`, `app/shared/src/androidMain`)
|
|
- Shared cross-platform code (`app/shared/src/commonMain`)
|
|
- Local encryption implementation (NaCl, AES-GCM)
|
|
- Secure storage (Android Keystore, encrypted SharedPreferences)
|
|
- WebSocket client security
|
|
- Permission usage and handling
|
|
- Call security (LiveKit integration)
|
|
- Memory safety and injection attacks
|
|
- Backend
|
|
|
|
## Important Design Decisions (NOT Vulnerabilities)
|
|
|
|
When auditing, remember these are **intentional design choices**:
|
|
|
|
1. **Local message caching** - Messages downloaded and stored locally (by design)
|
|
- Messages are end-to-end encrypted at rest in local DB
|
|
- Public DMs are not encrypted (messages are public)
|
|
- Private DMs use NaCl encryption
|
|
- Cache persists across app restarts for offline access
|
|
2. **Local key storage** - Encryption keys stored on device (by design)
|
|
- Keys protected by Android Keystore (hardware-backed when available)
|
|
- Encrypted with device-specific secrets
|
|
- User data never leaves device in plaintext
|
|
- Do NOT flag key storage as critical (Keystore is production-ready)
|
|
|
|
## Output Format
|
|
|
|
Provide a **clean, concise report** with:
|
|
|
|
1. **Executive Summary** - Overall rating and production readiness
|
|
2. **Security Status** - Critical issues (if any) and recommendations
|
|
3. **Security Strengths** - What's done well
|
|
4. **Component Ratings** - Table format for quick reference
|
|
5. **Architecture Review** - Data flow, encryption boundaries
|
|
6. **Threat Analysis** - Current realistic threats (e.g., rooted device, malicious APK)
|
|
7. **Recommendations** - Prioritized with time estimates
|
|
8. **Conclusion** - Clear production readiness statement
|
|
|
|
**Keep it under 500 lines** - focus on actionable findings, not verbose explanations.
|
|
|
|
## Common False Positives to Avoid
|
|
|
|
❌ **DO NOT FLAG THESE AS ISSUES:**
|
|
|
|
- Local message caching (intentional for offline access)
|
|
- Public message viewing without auth (intentional design)
|
|
- Debuggable APK (only relevant if signed/released)
|
|
|