Publications
============

This repro contains almost all of Cure53's publications and papers. 
Click "watch" to get a mail once we publish something fresh.

## Pentest-Reports & Papers

<h4 id="publications-2026">2026</h4>
<ul>
    <li><a href="pentest-report_forward-email.pdf"><strong>Pentest-Report Forward Email Architecture & Infrastructure</strong> 05.2026</a></li>
    <li><a href="pentest-report_expressvpn-eventvpn.pdf"><strong>Pentest-Report EventVPN Architecture & Software</strong> 02.-03.2026</a></li>
    <li><a href="pentest-report_expressvpn-mailguard_2026.pdf"><strong>Pentest-Report ExpressVPN ExpressMailGuard Service</strong> 02.-03.2026</a></li>
    <li><a href="review-report_pdfgear.pdf"><strong>Pentest-Report PDFgear Desktop App & Codebase</strong> 02.-03.2026</a></li>
    <li><a href="pentest-report_expressvpn-ai_2026.pdf"><strong>Pentest-Report ExpressVPN ExpressAI Client, Crypto & Infrastructure</strong> 03.2026</a></li>
    <li><a href="pentest-report_expressvpn-id-defender_2026.pdf"><strong>Pentest-Report ExpressVPN Identity Defender</strong> 03.2026</a></li>
    <li><a href="summary-report_aurorium-apps.pdf"><strong>Summary-Report Aurorium Apps, Admin & API</strong> 03.2026</a></li>
</ul>
<h4 id="publications-2025">2025</h4>
<ul>
    <li><a href="summary-report_tangem-crypto.pdf"><strong>Summary-Report Tangem Mobile Wallet Cryptography, SDK & Application</strong> Q4 2025</a></li>
    <li><a href="pentest-report_dive-cae.pdf"><strong>Pentest-Report Dive CAE Web UI, API & Infra</strong> 09.2025</a></li>
    <li><a href="summary-report_IDZ-crypto.pdf"><strong>Summary-Report IDZ Crypto Libraries, Mobile & Web</strong> 09.2025</a></li>
    <li><a href="audit-report_project-11-crypto.pdf"><strong>Audit-Report Project 11 Crypto Web UI & Backend</strong> 06.2025</a></li>
    <li><a href="pentest-report_project-11-web.pdf"><strong>Pentest-Report Project 11 Web App UI, API & Infra</strong> 06.2025</a></li>
    <li><a href="summary-report_tequity.pdf"><strong>Summary-Report Tequity Web App UIs, Games, APIs & Infra</strong> 05.2025</a></li>
    <li><a href="pentest-report_influx-wallet.pdf"><strong>Pentest-Report InFlux ZelCore Addon, Mobile & Desktop Wallet Apps</strong> 01.-02.2025</a></li>
    <li><a href="pentest-report_raspberry-web.pdf"><strong>Pentest-Report Raspberry Pi Web Applications, Client App & Infra</strong> 01.2025</a></li>
    <li><a href="pentest-report_hedera-snap_v3.pdf"><strong>Audit-Report Tuum Hedera Identify Snap & Codebase</strong> 01.2025</a></li>
</ul>
<h4 id="publications-2024">2024</h4>
<ul>
    <li><a href="audit-report_coinbase-kms.pdf"><strong>Audit-Report Coinbase cb-mpc Library Crypto</strong> 12.2024</a></li>
    <li><a href="pentest-report_expressvpn-lightway_2024.pdf"><strong>Audit-Report ExpressVPN Lightway Protocol</strong> 10.-11.2024</a></li>
    <li><a href="pentest-report_expressvpn-aircove_2024.pdf"><strong>Pentest-Report ExpressVPN Aircove Firmware</strong> 11.2024</a></li>
    <li><a href="pentest-report_keepassium.pdf"><strong>Pentest-Report KeePassium iOS Apps & Crypto</strong> 10.2024</a></li>
    <li><a href="pentest-report_antelope-snap.pdf"><strong>Audit-Report Greymass Antelope Snap & Codebase</strong> 09.2024</a></li>
    <li><a href="pentest-report_hedera-snap_2.pdf"><strong>Audit-Report Tuum Hedera Wallet Snap & Codebase</strong> 09.2024</a></li>
    <li><a href="pentest-report_obsidian-2.pdf"><strong>Pentest-Report Obsidian Clients & UI</strong> 09.2024</a></li>
    <li><a href="pentest-report_obsidian-3.pdf"><strong>Pentest-Report Obsidian Sync API, Server & Crypto</strong> 09.2024</a></li>
    <li><a href="summary-report_obsidian-2.pdf"><strong>Summary-Report Obsidian Clients & UI</strong> 09.2024</a></li>
    <li><a href="summary-report_obsidian-3.pdf"><strong>Summary-Report Obsidian Sync API, Server & Crypto</strong> 09.2024</a></li>
    <li><a href="audit-report_noble-crypto-libs.pdf"><strong>Audit-Report Paul Miller Noble Crypto Libraries</strong> 08.2024</a></li>
    <li><a href="pentest-report_tuum-auth-snap.pdf"><strong>Pentest-Report Tuum AuthFlow Snap & Codebase</strong> 08.2024</a></li>
    <li><a href="audit-report_nym.pdf"><strong>Audit-Report Nym Mobile & Desktop, VPN, Infra & Cryptography</strong> 07.2024</a></li>
    <li><a href="pentest-report_ODK.pdf"><strong>Pentest- & Review-Report ODK Mobile Apps, Server & Threat Model</strong> 07.2024</a></li>
    <li><a href="pentest-report_mullvad_2024_v1.pdf"><strong>Pentest-Report Mullvad VPN Relay-Infrastructure</strong> 06.2024</a></li>
    <li><a href="pentest-report_psiphon-conduit-library_2.pdf"><strong>Pentest-Report Psiphon Conduit Integration Codebase</strong> 04.-05.2024</a></li>
    <li><a href="pentest-report_expressvpn-vpn-extension_2.pdf"><strong>Pentest-Report ExpressVPN VPN Browser Extension</strong> 05.2024</a></li>
    <li><a href="pentest-report_psiphon_4.pdf"><strong>Pentest-Report Psiphon Tunnel Core Codebase</strong> 05.2024</a></li>
    <li><a href="audit-report_distrust-toolkit.pdf"><strong>Audit-Report Distrust Keyfork Toolkit & Library</strong> 04.2024</a></li>
    <li><a href="pentest-report_hedera-snap.pdf"><strong>Pentest-Report Hedera Wallet Snap & Sources</strong> 04.2024</a></li>
    <li><a href="pentest-report_kyraview-stellar-snap.pdf"><strong>Audit-Report Kyraview MetaMask Stellar Snap</strong> 04.2024</a></li>
    <li><a href="pentest-report_passbolt-uwp-app.pdf"><strong>Pentest-Report Passbolt UWP Windows App</strong> 03.2024</a></li>
    <li><a href="pentest-report_metamask-signing-snap.pdf"><strong>Pentest-Report MetaMask Signing Snap & Codebase</strong> 03.2024</a></li>
    <li><a href="pentest-report_IVPN_2024.pdf"><strong>Pentest-Report IVPN Customer Website & Servers</strong> 03.2024</a></li>
    <li><a href="pentest-report_bob-snap.pdf"><strong>Audit-Report BOB MetaMask Snap Codebase & Build</strong> 02.2024</a></li>
    <li><a href="pentest-report_rubic-snap.pdf"><strong>Audit-Report Rubic MetaMask Snap Build & Codebase</strong> 02.2024</a></li>
    <li><a href="summary-report_obsidian-1.pdf"><strong>Summary-Report Obsidian Clients & UI</strong> 01.2024</a></li>
    <li><a href="pentest-report_kryptogo.pdf"><strong>Pentest-Report KryptoGO Mobile, API & Infra</strong> 01.2024</a></li>
    <li><a href="audit-report_solidifi-staking-feature.pdf"><strong>Audit-Report SolidiFi Wallet Staking Feature</strong> 01.2024</a></li>
    <li><a href="pentest-report_threema-desktop.pdf"><strong>Pentest-Report Threema Desktop App</strong> 01.2024</a></li>
</ul>
<h4 id="publications-2023">2023</h4>
<ul>
    <li><a href="audit-report_nip44-implementations.pdf"><strong>Audit-Report NIP44 Implementations</strong> 11.-12.2023</a></li>
    <li><a href="pentest-report_dedaub-metamask-snap.pdf"><strong>Audit-Report Dedaub MetaMask Snap Code & Build</strong> 12.2023</a></li>
    <li><a href="pentest-report_obsidian-1.pdf"><strong>Pentest-Report Obsidian Clients & UI</strong> 11.2023</a></li>
    <li><a href="pentest-report_tuum-hedera-snap.pdf"><strong>Pentest-Report Tuum Hedera Wallet Snap & Code</strong> 11.2023</a></li>
    <li><a href="pentest-report_tunnelbear_2023.pdf"><strong>Pentest-Report TunnelBear VPN Clients & Servers</strong> 10.-11.2023</a></li>
    <li><a href="pentest-report_safeheron-snap.pdf"><strong>Pentest-Report Safeheron WASM MPC & Snap</strong> 09.2023</a></li>
    <li><a href="pentest-report_silencelabs-apps.pdf"><strong>Pentest-Report Silence Laboratories Silent Shard Mobile App, Web & Cloud</strong> 06.-07.2023</a></li>
    <li><a href="pentest-report_silencelabs-snap.pdf"><strong>Pentest-Report Silent Shard Snap</strong> 06.-07.2023</a></li>
    <li><a href="pentest-report_tuum-snap.pdf"><strong>Pentest-Report Tuum MetaMask Identify</strong> 07.2023</a></li>
    <li><a href="pentest-report_walletchat-snap.pdf"><strong>Pentest-Report WalletChat MetaMask Snap</strong> 07.2023</a></li>
    <li><a href="review-report_passbolt-directorytree.pdf"><strong>Audit-Report Passbolt DirectoryTree LdapRecord</strong> 07.2023</a></li>
    <li><a href="pentest-report_proton-pass.pdf"><strong>Pentest-Report Proton Pass Browser Addon, Apps & API</strong> 05.-06.2023</a></li>
    <li><a href="pentest-report_psiphon-conduit-library.pdf"><strong>Pentest-Report Psiphon Conduit Library</strong> 06.2023</a></li>
    <li><a href="pentest-report_authentik.pdf"><strong>Pentest-Report authentik IdP Web, API & SSO</strong> 05.2023</a></li>
    <li><a href="audit-report_ente-crypto.pdf"><strong>Audit-Report ente Crypto Design & Code</strong> 02.-03.2023</a></li>
    <li><a href="pentest-report_passbolt-sso.pdf"><strong>Pentest-Report Passbolt SSO, API & Add-On</strong> 02.-03.2023</a></li>
    <li><a href="summary-report_solidifi-wallet.pdf"><strong>Summary-Report SolidiFi Wallet Mobile Apps</strong> 01.-02.2023</a></li>
    <li><a href="audit-report_stealth-address.pdf"><strong>Audit-Report Stealth Address Implementation</strong> 02.2023</a></li>
    <li><a href="audit-report_privy-sss-library.pdf"><strong>Audit-Report Privy.io Shamir Secret Sharing</strong> 02.2023</a></li>
    <li><a href="pentest-report_IVPN_2023.pdf"><strong>Pentest-Report IVPN Gateway, Server & Setup</strong> 02.2023</a></li>
    <li><a href="audit-report_micro-btc-signer.pdf"><strong>Audit-Report micro-btc-signer TS Library</strong> 01.2023</a></li>
</ul>
<h4 id="publications-2022">2022</h4>
<ul>
    <li><a href="summary-report_nwse-identeco.pdf"><strong>Summary-Report NEW WORK SE Identeco Integration</strong> 12.2022</a></li>
    <li><a href="pentest-report_expressvpn-lightway.pdf"><strong>Pentest-Report ExpressVPN Lightway</strong> 10.-11.2022</a></li>
    <li><a href="pentest-report_tunnelbear_2022.pdf"><strong>Pentest-Report TunnelBear VPN</strong> 10.-11.2022</a></li>
    <li><a href="pentest-report_expressvpn-keys-extension.pdf"><strong>Pentest-Report ExpressVPN Keys Browser Extension</strong> 09.-10.2022</a></li>
    <li><a href="pentest-report_expressvpn-vpn-extension.pdf"><strong>Pentest-Report ExpressVPN VPN Browser Extension</strong> 09.-10.2022</a></li>
    <li><a href="pentest-report_nordvpn-infra.pdf"><strong>Pentest-Report NordVPN Server & Infra</strong> 09.-10.2022</a></li>
    <li><a href="audit-report_silencelabs-ecdsa-lib.pdf"><strong>Audit-Report Silence Laboratories ECDSA Library</strong> 10.2022</a></li>
    <li><a href="pentest-report_expressvpn-ios.pdf"><strong>Pentest-Report ExpressVPN iOS App</strong> 08.-09.2022</a></li>
    <li><a href="pentest-report_expressvpn-linux.pdf"><strong>Pentest-Report ExpressVPN Linux Clients</strong> 07.-08.2022</a></li>
    <li><a href="pentest-report_nordvpn-apps-addons.pdf"><strong>Pentest-Report NordVPN Apps & Add-ons</strong> 07.-08.2022</a></li>
    <li><a href="pentest-report_expressvpn-android.pdf"><strong>Pentest-Report ExpressVPN Android Client App & Integrations</strong> 08.2022</a></li>
    <li><a href="pentest-report_expressvpn-macos.pdf"><strong>Pentest-Report ExpressVPN macOS Client</strong> 06.-07.2022</a></li>
    <li><a href="pentest-report_expressvpn-aircove.pdf"><strong>Pentest-Report ExpressVPN Router Firmware (Aircove)</strong> 06.-07.2022</a></li>
    <li><a href="review-report_passbolt-crypto.pdf"><strong>Review-Report Passbolt Crypto Features</strong> 07.2022</a></li>
    <li><a href="summary-report_realvnc-connect.pdf"><strong>Summary-Report RealVNC VNC Connect</strong> 01.-05.2022</a>
    <li><a href="pentest-report_expressvpn-trusted-server.pdf"><strong>Pentest-Report ExpressVPN TrustedServer</strong> 04.-05.2022</a></li>
    <li><a href="summary-report_sonarqube-2022_1.pdf"><strong>Summary-Report SonarQube Web UI & API</strong> 03.2022</a>
    <li><a href="summary-report_opera-vpn.pdf"><strong>Summary-Report Opera VPN Server & Clients</strong> (Opera) 03.2022</a></li>
    <li><a href="pentest-report_1password-mobile.pdf"><strong>Pentest-Report 1Password Mobile Apps</strong> 02.-03.2022</a></li>
    <li><a href="summary-report_cake-defi.pdf"><strong>Summary-Report Cake DeFi Web UI & API</strong> 02.2022</li>
    <li><a href="pentest-report_IVPN_2022.pdf"><strong>Pentest-Report IVPN Apps & Daemon</strong> (IVPN) 02.2022</a></li>
    <li><a href="pentest-report_ed25519.pdf"><strong>Audit-Report TypeScript ed25519 Libraries</strong> 02.2022</a></li>
    <li><a href="pentest-report_rust-libs_2022.pdf"><strong>Audit-Report Rust crypto_secretbox & crypto_box Libraries</strong> (Threema) 02.2022</a></li>
</ul>
<h4 id="publications-2021">2021</h4>
<ul>
    <li><a href="pentest-report_1password-core-2021.pdf"><strong>Pentest-Report 1Password Core</strong> 11.-12.2021</a></li>
    <li><a href="pentest-report_hashing-libs.pdf"><strong>Audit-Report TypeScript Hashing Libraries</strong> 12.2021</a>
    <li><a href="pentest-report_passbolt-mobile-api.pdf"><strong>Pentest-Report Passbolt Mobile App & API</strong> 11.-12.2021</a></li>
    <li><a href="pentest-report_tunnelbear_2021.pdf"><strong>Pentest-Report TunnelBear VPN</strong> 11.-12.2021</a></li>
    <li><a href="pentest-report_pgpainless.pdf"><strong>Pentest-Report PGPainless</strong> 11.2021</a>
    <li><a href="summary-report_sonarcloud-2021.pdf"><strong>Summary-Report SonarCloud Web UI & API</strong> 11.2021</a>
    <li><a href="pentest-report_psiphon_3.pdf"><strong>Pentest-Report Psiphon api-gatekeeper</strong> 11.2021</a>
    <li><a href="pentest-report_1password-b5-2021.pdf"><strong>Pentest-Report 1Password B5 Web Application</strong> 10.2021</a></li>
    <li><a href="summary-report_sonarqube-2021_2.pdf"><strong>Summary-Report SonarQube Web UI & API</strong> 10.2021</a>
    <li><a href="pentest-report_passbolt-ext-integration.pdf"><strong>Pentest-Report Passbolt Extension Integration</strong> 08.2021</a></li>
    <li><a href="pentest-report_bifrost-wallet.pdf"><strong>Pentest-Report Towo Bifrost Wallet</strong> 06.2021</a></li>
    <li><a href="pentest-report_passbolt-backend.pdf"><strong>Pentest-Report Passbolt Backend & Plugins</strong> 06.2021</a></li>
    <li><a href="pentest-report_turbotunnel.pdf"><strong>Review-Report Turbo Tunnel</strong> (UCB) 04.2021</a></li>
    <li><a href="summary-report_sonarqube-2021.pdf"><strong>Summary-Report SonarQube Data Center Edition</strong> 04.2021</a>
    <li><a href="pentest-report_noble-lib.pdf"><strong>Review-Report noble-secp256k1 Library</strong> 04.2021</a></li>
    <li><a href="pentest-report_swarm.pdf"><strong>Pentest-Report Swarm</strong> 03.-04.2021</a></li>
    <li><a href="pentest-report_passbolt-extensions.pdf"><strong>Pentest-Report Passbolt Browser Extensions</strong> 04.2021</a></li>
    <li><a href="pentest-report_pomerium.pdf"><strong>Pentest-Report Pomerium</strong> 03.2021</a></li>
    <li><a href="pentest-report_mozilla-vpn.pdf"><strong>Pentest-Report Mozilla VPN Apps & Client</strong> (Mozilla) 03.2021</a></li>
    <li><a href="pentest-report_lightway.pdf"><strong>Review-Report ExpressVPN Lightway Protocol</strong> 03.2021</a></li>
    <li><a href="pentest-report_veepn.pdf"><strong>Pentest-Report VeePN Browser Extension</strong> 03.2021</a></li>
    <li><a href="pentest-report_IVPN.pdf"><strong>Pentest-Report IVPN Apps & Daemon</strong> 03.2021</a></li>
    <li><a href="review-report_passbolt-whitepaper.pdf"><strong>Review-Report Passbolt Security White Paper</strong> 02.2021</a></li>
</ul>
<h4 id="publications-2020">2020</h4>
<ul>
    <li><a href="pentest-report_mullvad_2021_v1.pdf"><strong>Pentest-Report Mullvad VPN & Servers</strong> 11.-12.2020</a></li>
    <li><a href="pentest-report_contour.pdf"><strong>Pentest-Report Contour</strong> (CNCF) 11.2020</a></li>
    <li><a href="pentest-report_php-saml-sp.pdf"><strong>Pentest-Report php-saml-sp</strong> (DeIC) 10.-11.2020</a></li>
    <li><a href="pentest-report_tunnelbear_2020.pdf"><strong>Pentest-Report Tunnelbear VPN & Software</strong> 10.2020</a>
    <li><a href="pentest-report_1password-b5.pdf"><strong>Pentest-Report 1Password B5 Web Application</strong> 10.2020</a></li>
    <li><a href="pentest-report_threema.pdf"><strong>Pentest-Report Threema Mobile Apps</strong> 10.2020</a></li>
    <li><a href="pentest-report_chubaofs.pdf"><strong>Pentest-Report ChubaoFS</strong> (CNCF) 08.-09.2020</a></li>
    <li><a href="pentest-report_rnp.pdf"><strong>Pentest-Report Thunderbird & RNP</strong> (MOSS) 08.2020</a></li>
    <li><a href="pentest-report_nodeexporter.pdf"><strong>Pentest-Report node_exporter</strong> (CNCF) 07.2020</a></li>
    <li><a href="pentest-report_psipy.pdf"><strong>Pentest-Report Psiphon psipy Library</strong> 07.2020</a></li>
    <li><a href="pentest-report_formsg.pdf"><strong>Pentest-Report GovTech FormSG Web & API</strong> 07.2020</a></li>
    <li><a href="pentest-report_dapr.pdf"><strong>Pentest-Report Dapr</strong> 06.2020</a></li>
    <li><a href="pentest-report_monocypher.pdf"><strong>Audit-Report Monocypher Crypto Library</strong> (OTF) 06.2020</a></li>
    <li><a href="pentest-report_rustls.pdf"><strong>Pentest-Report rustls</strong> (CNCF) 05.-06.2020</a></li>
    <li><a href="pentest-report_mullvad_2020_v2.pdf"><strong>Pentest-Report Mullvad Apps, Clients & API</strong> 05.2020</a></li>
    <li><a href="pentest-report_request.pdf"><strong>Pentest-Report Request Network</strong> 05.2020</a></li>
    <li><a href="pentest-report_mullvad_2020_v1.pdf"><strong>Pentest-Report Mullvad Apps, Clients & API (v1)</strong> 05.2020</a></li>
    <li><a href="pentest-report_tikv.pdf"><strong>Pentest-Report TiKV</strong> (CNCF) 02.2020</a></li>
    <li><a href="pentest-report_safing-jess.pdf"><strong>Audit-Report Safing Jess Crypto-Library</strong> 01.2020</a></li>
    <li><a href="pentest-report_flowcrypt.pdf"><strong>Pentest-Report FlowCrypt</strong> (OTF) 01.2020</a></li>
    <li><a href="summary-report_ivpn_2019.pdf"><strong>Summary-Report IVPN VPN, Server & Web</strong> 01.2020</a></li>
</ul>
<h4 id="publications-2019">2019</h4>
<ul>
    <li><a href="pentest-report_runc.pdf"><strong>Pentest-Report runc</strong> (CNCF) 11.-12.2019</a></li>
    <li><a href="summary-report_tunnelbear_2019.pdf"><strong>Summary-Report TunnelBear</strong> 11.2019</a></li>
    <li><a href="pentest-report_keycloak.pdf"><strong>Pentest-Report Keycloak</strong> 11.2019</a></li>
    <li><a href="pentest-report_helm.pdf"><strong>Pentest-Report Helm</strong> (CNCF) 10.-11.2019</a></li>
    <li><a href="pentest-report_standardnotes.pdf"><strong>Pentest-Report Standard Notes</strong> 10.2019</a></li>
    <li><a href="pentest-report_harbor.pdf"><strong>Pentest-Report Harbor</strong> (CNCF) 10.2019</a></li>
    <li><a href="pentest-report_grpc.pdf"><strong>Pentest-Report gRPC</strong> (CNCF) 10.2019</a></li>
    <li><a href="pentest-report_psiphon_2.pdf"><strong>Pentest-Report Psiphon Apps & Server</strong> 10.2019</a></li>
    <li><a href="pentest-report_libssh.pdf"><strong>Pentest-Report libssh C Library</strong> (MOSS) 09.2019</a></li>
    <li><a href="analysis-report_sgn.pdf"><strong>Analysis-Report "Study the Great Nation" Android App</strong> (OTF) 09.2019</a></li>
    <li><a href="pentest-report_rancher.pdf"><strong>Pentest-Report Rancher Web & API</strong> 07.2019</a></li>
    <li><a href="pentest-report_falco.pdf"><strong>Pentest-Report Falco</strong> (CNCF) 07.2019</a></li>
    <li><a href="pentest-report_linkerd2.pdf"><strong>Pentest-Report Linkerd2</strong> (CNCF) 06.2019</a></li>
    <li><a href="pentest-report_fluent.pdf"><strong>Pentest-Report Fluentd/Fluent-Bit</strong> (CNCF) 05.2019</a></li>
    <li><a href="pentest-report_jaeger.pdf"><strong>Pentest-Report Jaeger</strong> (CNCF) 05.2019</a></li>
    <li><a href="pentest-report_peergos.pdf"><strong>Pentest-Report Peergos Crypto & Software</strong> 05.2019</a></li>
    <li><a href="analysis-report_fng.pdf"><strong>Analysis-Report Chinese Police App "Feng Cai"</strong> (OTF) 03.2019</a></li>
    <li><a href="pentest-report_exodus.pdf"><strong>Pentest-Report Exodus iOS Mobile App</strong> 03.2019</a></li>
    <li><a href="audit-report_ivpn.pdf"><strong>Audit-Report IVPN Privacy & No-Log</strong> 03.2019</a></li>
    <li><a href="pentest-report_vitess.pdf"><strong>Pentest-Report Vitess</strong> (CNCF) 02.2019</a></li>
</ul>
<h4 id="publications-2018">2018</h4>
<ul>
    <li><a href="analysis-report_ijop.pdf"><strong>Analysis-Report Chinese Police App "IJOP"</strong> (HRW) 12.2018</a></li>
    <li><a href="pentest-report_jigsaw-outline.pdf"><strong>Pentest- & Audit-Report Jigsaw Outline</strong> 09.-12.2018</a></li>
    <li><a href="pentest-report_nats.pdf"><strong>Pentest-Report NATS</strong> (CNCF) 11.2018</a></li>
    <li><a href="pentest-report_containerd.pdf"><strong>Pentest-Report containerd</strong> (CNCF) 11.2018</a></li>
    <li><a href="pentest-report_surfshark.pdf"><strong>Pentest-Report Surfshark</strong> 11.2018</a></li>
    <li><a href="pentest-report_bitwarden.pdf"><strong>Pentest-Report Bitwarden</strong> 11.2018</a></li>
    <li><a href="pentest-report_expressvpn.pdf"><strong>Pentest-Report ExpressVPN Extension</strong> 10.-11.2018</a></li>
    <li><a href="summary-report_tunnelbear_2018.pdf"><strong>Summary-Report TunnelBear</strong> 10.2018</a></li>
    <li><a href="pentest-report_cryptech.pdf"><strong>Pentest-Report CrypTech/DiamondKey</strong> 09.2018</a></li>
    <li><a href="pentest-report_frame.pdf"><strong>Pentest-Report Frame Electron App</strong> 09.2018</a></li>
    <li><a href="pentest-report_mullvad_v2.pdf"><strong>Pentest-Report Mullvad VPN Clients</strong> 09.2018</a></li>
    <li><a href="pentest-report_mullvad_v1.pdf"><strong>Pentest-Report Mullvad VPN Clients (v1)</strong> 09.2018</a></li>
    <li><a href="pentest-report_opa.pdf"><strong>Pentest-Report Open Policy Agent</strong> (CNCF) 08.2018</a></li>
    <li><a href="pentest-report_cuckoo.pdf"><strong>Pentest-Report Cuckoo Sandbox</strong> 07.2018</a></li>
    <li><a href="pentest-report_gyroscope.pdf"><strong>Pentest-Report Antradar Gyroscope</strong> 07.2018</a></li>
    <li><a href="pentest-report_mycrypto.pdf"><strong>Pentest-Report MyCrypto App</strong> 06.2018</a></li>
    <li><a href="pentest-report_tuf.pdf"><strong>Pentest-Report TUF/Notary</strong> (CNCF) 05.-06.2018</a></li>
    <li><a href="pentest-report_prometheus.pdf"><strong>Pentest-Report Prometheus</strong> (CNCF) 05.-06.2018</a></li>
    <li><a href="pentest-report_imtoken.pdf"><strong>Pentest-Report imToken Wallet</strong> 05.2018</a></li>
    <li><a href="pentest-report_teleport_2.pdf"><strong>Pentest-Report Gravitational Teleport</strong> 05.2018</a></li>
    <li><a href="pentest-report_coredns.pdf"><strong>Pentest-Report CoreDNS</strong> (CNCF) 02.-03.2018</a></li>
    <li><a href="pentest-report_envoy.pdf"><strong>Pentest-Report Envoy Proxy</strong> (CNCF) 02.2018</a></li>
    <li><a href="pentest-report_whistler.pdf"><strong>Pentest-Report Whistler</strong> (BAM) 02.2018</a></li>
    <li><a href="pentest-report_mew.pdf"><strong>Pentest-Report MyEtherWallet Website</strong> 01.2018</a></li>
</ul>
<h4 id="publications-2017">2017</h4>
<ul>
    <li><a href="pentest-report_simplesamlphp.pdf"><strong>Pentest-Report SimpleSAMLphp</strong> (MOSS) 11.2017</a></li>
    <li><a href="pentest-report_thunderbird-enigmail.pdf"><strong>Pentest-Report Thunderbird & Enigmail</strong> (MOSS) 09.2017</a></li>
    <li><a href="pentest-report_metamask.pdf"><strong>Pentest-Report MetaMask</strong> 08.2017</a></li>
    <li><a href="pentest-report_telekube.pdf"><strong>Pentest-Report Gravitational Telekube</strong> 08.2017</a></li>
    <li><a href="pentest-report_remembear.pdf"><strong>Pentest-Report RememBear</strong> 08.2017</a></li>
    <li><a href="summary-report_tunnelbear.pdf"><strong>Summary-Report TunnelBear</strong> 07.2017</a></li>
    <li><a href="pentest-report_psiphon.pdf"><strong>Pentest-Report Psiphon</strong> 07.2017</a></li>
    <li><a href="summary-report-appendix_tunnelbear.pdf"><strong>Summary-Report Appendix TunnelBear</strong> 07.2017</a></li>
    <li><a href="pentest-report_teleport.pdf"><strong>Pentest-Report Gravitational Teleport</strong> 04.2017</a></li>
    <li><a href="pentest-report_briar.pdf"><strong>Pentest-Report Briar Project App & Protocol</strong> (OTF) 03.2017</a></li>
    <li><a href="pentest-report_ntp.pdf"><strong>Pentest-Report NTP</strong> (MOSS) 03.2017</a></li>
    <li><a href="pentest-report_ntpsec.pdf"><strong>Pentest-Report NTPsec</strong> (MOSS) 03.2017</a></li>
</ul>
<h4 id="publications-2016">2016</h4>
<ul>
    <li><a href="pentest-report_mist.pdf"><strong>Pentest-Report Ethereum Mist</strong> 11.2016</a></li>
    <li><a href="pentest-report_dovecot.pdf"><strong>Pentest-Report Dovecot</strong> (MOSS) 11.2016</a></li>
    <li><a href="pentest-report_fxa.pdf"><strong>Pentest-Report Mozilla FxA</strong> 09.2016</a></li>
    <li><a href="pentest-report_curl.pdf"><strong>Pentest-Report cURL</strong> (MOSS) 08.2016</a></li>
    <li><a href="pentest-report_accessmyinfo.pdf"><strong>Pentest-Report Access My Info</strong> (OTF) 05.2016</a></li>
    <li><a href="pentest-report_padlock.pdf"><strong>Pentest-Report Padlock</strong> (OTF) 04.2016</a></li>
    <li><a href="pentest-report_libjpeg-turbo.pdf"><strong>Pentest-Report libjpeg-turbo</strong> (MOSS) 01.2016</a></li>
</ul>
<h4 id="publications-2015">2015 and earlier</h4>
<ul>
    <li><a href="pentest-report_pcre.pdf"><strong>Pentest-Report PCRE</strong> (MOSS) 10.2015</a></li>
    <li><a href="pentest-report_peerio.pdf"><strong>Pentest-Report Peerio</strong> (OTF) 09.2015</a></li>
    <li><a href="pentest-report_smartsheriff-2.pdf"><strong>Pentest-Report SmartSheriff 2</strong> (OTF) 10.2015</a></li>
    <li><a href="pentest-report_openkeychain.pdf" target="_blank"><strong>Pentest-Report OpenKeychain</strong> (OTF) 08.2015</a></li>
    <li><a href="pentest-report_nitrokey.pdf" target="_blank"><strong>Pentest-Report Nitrokey Storage Firmware</strong> (OTF) 08.2015</a></li>
    <li><a href="pentest-report_nitrokey-hardware.pdf" target="_blank"><strong>Pentest-Report Nitrokey Storage Hardware</strong> (OTF) 05.2015</a></li>
    <li><a href="pentest-report_smartsheriff.pdf" target="_blank"><strong>Pentest-Report SmartSheriff</strong> (OTF) 07.2015</a></li>
    <li><a href="pentest-report_cyph.pdf" target="_blank"><strong>Pentest-Report Cyph</strong> (OTF) 06.2015</a></li>
    <li><a href="pentest-report_SC4.pdf" target="_blank"><strong>Pentest-Report SC4</strong> 06.2015</a></li>
    <li><a href="pentest-report_whiteout.pdf" target="_blank"><strong>Pentest-Report Whiteout</strong> 06.2015</a></li>
    <li><a href="pentest-report_streamcryptor.pdf" target="_blank"><strong>Pentest-Report StreamCryptor</strong> 04.2015</a></li>
    <li><a href="pentest-report_dompurify.pdf"><strong>Pentest-Report DOMPurify</strong> 02.2015</a></li>
    <li><a href="pentest-report_fdroid.pdf" target="_blank"><strong>Pentest-Report F-Droid / Bazaar</strong> (RFA) 01.2015</a></li>
    <li><a href="pentest-report_casebox-1.pdf" target="_blank"><strong>Pentest-Report CaseBox (Code Audit)</strong> (RFA) 06.2014</a></li>
    <li><a href="pentest-report_casebox-2.pdf" target="_blank"><strong>Pentest-Report CaseBox (Production)</strong> (RFA) 08.2014</a></li>
    <li><a href="pentest-report_minilock.pdf" target="_blank"><strong>Pentest-Report miniLock</strong> (RFA) 07.2014</a></li>
    <li><a href="pentest-report_clipperz.pdf" target="_blank"><strong>Pentest-Report Clipperz</strong> (RFA) 04.2014</a></li>
    <li><a href="pentest-report_onion-browser.pdf" target="_blank"><strong>Pentest-Report Onion Browser</strong> (RFA) 04.2014</a></li>
    <li><a href="pentest-report_openpgpjs.pdf" target="_blank"><strong>Pentest-Report OpenPGP.js</strong> (RFA) 03.2014</a></li>
    <li><a href="pentest-report_securedrop.pdf" target="_blank"><strong>Pentest-Report SecureDrop</strong> (FPF) 12.2013</a></li>
    <li><a href="pentest-report_globaleaks.pdf" target="_blank"><strong>Pentest-Report Globaleaks</strong> (RFA) 06.2013</a></li>
    <li><a href="pentest-report_mailvelope.pdf" target="_blank"><strong>Pentest-Report Mailvelope</strong> (RFA) 12.2012 – 02.2013</a></li>
    <li><a href="https://pentestreports.com/reports/Cure53/pentest-report_Cryptocat-2.pdf" target="_blank"><strong>Pentest Report Cryptocat 2</strong>  (RFA) 11.2012</a></li>
</ul>
<h2>White Papers</h2>
<ul>
    <li><a href="https://github.com/cure53/browser-sec-whitepaper" target="_blank">Cure53 Browser Security White Paper</a></li>
    <li><a href="es6-for-penetration-testers.pdf" target="_blank">ECMAScript 6 for Penetration Testers - How the new JS changes Web- and DOM Security</a></li>
    <li><a href="xfo-clickjacking.pdf" target="_blank">X-Frame-Options: All about Clickjacking?</a></li>
</ul>
<h3>Academic Papers</h3>
<ul>
    <li><a href="https://link.springer.com/chapter/10.1007/978-3-319-66399-9_7" target="_blank">DOMPurify: Client-Side Protection Against XSS and Markup Injection</a></li>
    <li><a href="http://syssec.rub.de/media/emma/veroeffentlichungen/2015/05/27/sanitization_issta15.pdf" target="_blank">Ex­pe­ri­ence Re­port: An Em­pi­ri­cal Study of PHP Se­cu­ri­ty Me­cha­nism Usage</a></li>
    <li><a href="es6-for-penetration-testers.pdf" target="_blank">ECMAScript 6 for Penetration Testers - How the new JS changes Web- and DOM Security</a></li>
    <li><a href="http://syssec.rub.de/media/emma/veroeffentlichungen/2014/07/29/secondOrder-Usenix14.pdf" target="_blank">Static Detection of Second-Order Vulnerabilities in Web Applications</a></li>
    <li><a href="http://syssec.rub.de/media/emma/veroeffentlichungen/2014/09/10/POPChainGeneration-CCS14.pdf" target="_blank">Code Reuse Attacks in PHP: Automated POP Chain Generation</a></li>
    <li><a href="http://www.nds.rub.de/media/nds/veroeffentlichungen/2014/07/09/DSN_paper.pdf" target="_blank">Script­less Ti­ming At­tacks on Web Brow­ser Pri­va­cy</a></li>
    <li><a href="xfo-clickjacking.pdf" target="_blank">X-Frame-Options: All about Clickjacking?</a></li>
    <li><a href="http://www.syssec.rub.de/media/emma/veroeffentlichungen/2014/01/21/rips-NDSS14.pdf" target="_blank">Simulation of Built-in PHP Features for Precise Static Code Analysis</a></li>
    <li><a href="fp170.pdf" target="_blank">mXSS Attacks: Attacking well-secured Web-Applications by using innerHTML Mutations</a></li>
    <li><a href="http://www.nds.rub.de/research/publications/SS-FP-Heiderich/" target="_blank">SS-FP: Browser Finger­printing using HTML Parser Quirks </a></li>
    <li><a href="http://www.nds.rub.de/research/publications/scriptless-attacks/" target="_blank">Scriptless Attacks – Stealing the Pie Without Touching the Sill </a></li>
    <li><a href="http://www.nds.rub.de/research/publications/clickjacking/" target="_blank">On the Fragility and Limitations of Current Browser-provided Cli­ck­ja­cking Pro­tec­tion Sche­mes</a></li>
    <li><a href="http://www.nds.rub.de/research/publications/SVG-security-risks/" target="_blank">Crouching Tiger – Hidden Payload: Security Risks of Scalable Vectors Graphics </a></li>
    <li><a href="http://www.nds.rub.de/research/publications/SecurityCaseStudyHeliosVoting/" target="_blank">The Bug that made me President: A Browser- and Web-Security Case Study on Helios Voting</a></li>
    <li><a href="http://www.nds.rub.de/research/publications/iceshield-detection-and-mitigation-malicious-sites/" target="_blank">Ice­Shield: Detection and Miti­ga­ti­on of Malicious Websites with a Frozen DOM </a></li>
    <li><a href="http://www.nds.rub.de/research/publications/amazon-hacking/" target="_blank">All Your Clouds are Be­long to us – Se­cu­ri­ty Ana­ly­sis of Cloud Management Inter­faces </a></li>
</ul>
<h2>Presentations</h2>
<ul>
    <li><a href="https://speakerdeck.com/filedescriptor/exploiting-the-unexploitable-with-lesser-known-browser-tricks" target="_blank"><strong>Exploiting the unexploitable with lesser known browser tricks</strong></a></li>
    <li><a href="https://www.slideshare.net/x00mario/an-abusive-relationship-with-angularjs" target="_blank"><strong>An Abusive Relationship with AngularJS</strong></a></li>
    <li><a href="http://www.slideshare.net/x00mario/copypest" target="_blank"><strong>Copy &amp; Pest</strong> – A case-study on the clipboard, blind trust and invisible cross-application XSS</a></li>
    <li><a href="http://www.slideshare.net/x00mario/es6-en" target="_blank"><strong>ECMAScript 6 from an Attacker's Perspective</strong> – Breaking Frameworks, Sandboxes & everything else</a></li>
    <li><a href="http://www.slideshare.net/x00mario/in-the-dom-no-one-will-hear-you-scream" target="_blank"><strong>In the DOM, no one will hear you scream</strong> – A journey into the moldy layer between HTML and JS</a></li>
    <li><a href="http://www.slideshare.net/x00mario/jsmvcomfg-to-sternly-look-at-javascript-mvc-and-templating-frameworks" target="_blank"><strong>JSMVCOMFG</strong> – To sternly look at JavaScript MVC and Templating Frameworks</a></li>
    <li><a href="http://www.slideshare.net/x00mario/the-innerhtml-apocalypse" target="_blank"><strong>The innerHTML Apocalypse</strong> – How mXSS attacks change everything we believed to know so far</a></li>
    <li><a href="http://www.slideshare.net/x00mario/stealing-the-pie" target="_blank"><strong>Scriptless Attacks</strong> – Stealing the Pie without touching the Sill</a></li>
    <li><a href="http://www.slideshare.net/x00mario/the-image-that-called-me" target="_blank"><strong>The Image that called me</strong> – Active Content Injection with SVG Files</a></li>
    <li><a href="http://www.slideshare.net/x00mario/locking-the-throneroom-20" target="_blank"><strong>Locking the Throne Room</strong> – How ES5+ will change XSS and Client Side Security</a></li>
</ul>
<h2>Tools & Software</h2>
<ul>
    <li><a href="https://github.com/cure53/DOMPurify" target="_blank">DOMPurify</a></li>
	<li><a href="https://github.com/cure53/DOMFortify" target="_blank">DOMFortify</a></li>
	<li><a href="https://github.com/cure53/Contracts" target="_blank">Contracts</a></li>
    <li><a href="https://github.com/cure53/HTTPLeaks" target="_blank">HTTPLeaks</a></li>
    <li><a href="https://github.com/cure53/H5SC" target="_blank">HTML5 Security Cheatsheet</a></li>
</ul>