publications VS wstg

Disagree, their reputation is tied to their audit quality.

But I'm pretty sure in this case the scope was bad. Like they coukd have had audits on "Do I use OpenSSL well?" and then misrepresent that all their privacy claims were audited.

Now it seems like Skiff conveniently didn't allow Trail of Bits to publish their reports, they are usually here: https://github.com/trailofbits/publications/tree/master/revi...

Disclaimer, I have used Trail of Bits service in the past (and 2 other auditors for an security campaign on a blockchain, cryptography + networking product).

Link to the report: https://github.com/trailofbits/publications/blob/master/revi...

They seem to not have analysed client-side of PIP itself, but I suppose there isn't anything you could say that isn't already obvious to everyone.

Audits are mentioned on the Trail of Bits website https://github.com/trailofbits/publications and the Skiff one https://skiff.com/transparency. Skiff has been externally audited 4 times.

Here's the URL https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf It was in the article I have already linked.

MYSO Finance Security Assesment by Trail of Bits

Trail of Bits

Hi! I'm Skiff's CEO. We've had 3 security audits, including 2 from Trail of Bits - one of the best security auditing firms in the world https://github.com/trailofbits/publications. Skiff Mail is also open-source: https://github.com/skiff-org/skiff-mail as is our whitepaper https://skiff.com/whitepaper We've also been in the news quite a bit: https://www.theverge.com/2022/5/17/23075804/skiff-mail-email-privacy, https://www.wsj.com/articles/encryption-bans-what-is-this-russia-hacking-online-privacy-security-data-signal-whatsapp-emails-protection-11675436242 (I wrote this with our team!), https://techcrunch.com/2023/01/30/russia-skiff-block/, and more, even though we're only a year old. We collect no personally identifying information - not even IP addresses used - no backup emails, phones, etc. - no advertising, and we end-to-end encrypt BOTH email subject + body and don't have any metadata (time sent/received an exception). What can we do to share more of this with more people? We're a younger company but it's so important this is made public.

Hi! I'm Skiff's CEO. We've had 3 security audits, including 2 from Trail of Bits - likely the best security auditing firm in the world https://github.com/trailofbits/publications. Skiff Mail is also open-source: https://github.com/skiff-org/skiff-mail as is our whitepaper https://skiff.com/whitepaper

At the beginning, I read all things in here https://owasp.org/www-project-web-security-testing-guide/, also gets familiars with owasp top 10. But later on, I focus on a few techniques only.

I highly recommend PortSwigger's Web Security Academy and have a look at the OWASP Web Security Testing Guide.

You can follow OWASP web testing guide to learn about the test cases performed during testing.

Most web app testing is performed using this guide https://owasp.org/www-project-web-security-testing-guide/

I highly recommend the OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide/

Hi, sit and learn https://owasp.org/www-project-web-security-testing-guide/ that's the best way, than may be EJPT.

A short-lived branch-per-issue helps ensure that its resulting pull request doesn’t get too large, making it unwieldy and hard to review carefully. The definition of “short” varies depending on the team or project’s development velocity: for a small team producing a commercial app (like a startup), the time from issue branch creation to PR probably won’t exceed a week. For open source projects like the OWASP WSTG that depends on volunteers working around busy schedules, branches may live for a few weeks to a few months, depending on the contributor. Generally, strive to iterate in as little time as possible.