{
  "schemaVersion": 1,
  "date": "2026-10-30",
  "assessmentType": "Internal Security Assessment",
  "status": "partial",
  "baseCommit": "b1375b306e7ba2b823dfeabe8398950b510d749b",
  "sourceDigest": "23628410e692a11bdd36b4e72dbae715cb636b43bf450f846d7b1a2e568ddcdb",
  "sourceKind": "modified working tree; base commit alone is not the assessed release",
  "versions": {
    "backend": "0.9.6",
    "website": "0.9.6",
    "apk": "0.9.16",
    "apkBuild": 64
  },
  "counts": {
    "passed": 145,
    "failed": 3,
    "notTested": 17,
    "applicable": 165
  },
  "findings": {
    "critical": 0,
    "high": 1,
    "medium": 0,
    "low": 0
  },
  "lastSuccessfulVerification": "2026-10-30",
  "tools": [
    "Node.js 24.18.0",
    "OWASP ZAP 2.17.0",
    "Trivy 0.76.1",
    "OSV-Scanner 2.7.0",
    "Semgrep CE 1.183.0",
    "Gitleaks 8.30.1",
    "OpenSSL 3.0.13",
    "Android aapt/apksigner 36.0.0"
  ],
  "standards": {
    "ASVS": "5.0.0",
    "WSTG": "4.2",
    "API Security Top 10": "2023",
    "MASVS": "2.1.0",
    "MASTG": "2.0.0"
  },
  "checks": [
    {
      "id": "API-001",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-002",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-003",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-004",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-005",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-006",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-007",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-008",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-009",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-010",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-011",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-012",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-013",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-014",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-015",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-016",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-017",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-018",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-019",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-020",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-021",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-022",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-023",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-024",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-025",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-026",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-027",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-028",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-029",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-030",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-031",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-032",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-033",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-034",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-035",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-036",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-037",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-038",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-039",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-040",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-041",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-042",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-043",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-044",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-045",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-046",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-047",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-048",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-049",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-050",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-051",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-052",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-053",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-054",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-055",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-056",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-057",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-058",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-059",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-060",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-061",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-062",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-063",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-064",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-065",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-066",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-067",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-068",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-069",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-070",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-071",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-072",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-073",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-074",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-075",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-076",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-077",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-078",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-079",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-080",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "a606f601b87b4419f77a8fa09060bd602c8930ea768004291e58abdc2533ed25"
    },
    {
      "id": "API-081",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-082",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-083",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-084",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-085",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-086",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-087",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-088",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-089",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-090",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-091",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-092",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-093",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-094",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-095",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-096",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-097",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-098",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-099",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-100",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-101",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "API-102",
      "component": "API/backend",
      "status": "PASS",
      "evidenceDigest": "b0d077886a86718d7c3661189191ba52610ec8b14dfe75505b9bf1a8450fbcd8"
    },
    {
      "id": "HTTP-103",
      "component": "HTTP parser",
      "status": "PASS",
      "evidenceDigest": "e02d2abb0e46c37b265db8da87797f71b9ce933db05d40ce44e6bbaa7370726b"
    },
    {
      "id": "HTTP-104",
      "component": "HTTP parser",
      "status": "PASS",
      "evidenceDigest": "e02d2abb0e46c37b265db8da87797f71b9ce933db05d40ce44e6bbaa7370726b"
    },
    {
      "id": "CRYPTO-01",
      "component": "LGS1",
      "status": "PASS",
      "evidenceDigest": "2532d72f9a61b5ac00d0ab5ee405549097357a6155a1f86b688e1c08b947ca93"
    },
    {
      "id": "CRYPTO-02",
      "component": "LGS1",
      "status": "PASS",
      "evidenceDigest": "2532d72f9a61b5ac00d0ab5ee405549097357a6155a1f86b688e1c08b947ca93"
    },
    {
      "id": "CRYPTO-03",
      "component": "LGS1",
      "status": "PASS",
      "evidenceDigest": "2532d72f9a61b5ac00d0ab5ee405549097357a6155a1f86b688e1c08b947ca93"
    },
    {
      "id": "CRYPTO-04",
      "component": "LGS1",
      "status": "PASS",
      "evidenceDigest": "2532d72f9a61b5ac00d0ab5ee405549097357a6155a1f86b688e1c08b947ca93"
    },
    {
      "id": "CRYPTO-05",
      "component": "LGS1",
      "status": "PASS",
      "evidenceDigest": "2532d72f9a61b5ac00d0ab5ee405549097357a6155a1f86b688e1c08b947ca93"
    },
    {
      "id": "CRYPTO-06",
      "component": "LGS1",
      "status": "PASS",
      "evidenceDigest": "2532d72f9a61b5ac00d0ab5ee405549097357a6155a1f86b688e1c08b947ca93"
    },
    {
      "id": "CRYPTO-07",
      "component": "LGS1",
      "status": "PASS",
      "evidenceDigest": "2532d72f9a61b5ac00d0ab5ee405549097357a6155a1f86b688e1c08b947ca93"
    },
    {
      "id": "TLS-01",
      "component": "TLS",
      "status": "PASS",
      "evidenceDigest": "60fc5bb4d8ec701755c231c9b6f49d31f7814e29152930e5d94c9fa36d7fe9d8"
    },
    {
      "id": "TLS-02",
      "component": "TLS",
      "status": "PASS",
      "evidenceDigest": "99b4741ba9b0218bfc970285cc7f29b8813e8fb67d229b58ee513461535a6abb"
    },
    {
      "id": "TLS-03",
      "component": "TLS",
      "status": "PASS",
      "evidenceDigest": "306a55ef92df51d51bd2b2f4e4ac7f5008c5d79dce61a7f16149f2be64e27541"
    },
    {
      "id": "TLS-04",
      "component": "TLS",
      "status": "PASS",
      "evidenceDigest": "8d6ab2d30d16d77ac8e2756f528ae91735993550b17ea4b59f755e31b08e17a6"
    },
    {
      "id": "TLS-05",
      "component": "TLS",
      "status": "PASS",
      "evidenceDigest": "aeef110ace18e38ce53cb7760fbee142e2fb5eaa79e27ae4f032929f3d104b80"
    },
    {
      "id": "TLS-06",
      "component": "TLS",
      "status": "PASS",
      "evidenceDigest": "c7a2eefd1eb416eb927435c746c4504bbc318d1a80f49094b31d34370449dc97"
    },
    {
      "id": "TLS-07",
      "component": "TLS",
      "status": "PASS",
      "evidenceDigest": "306a55ef92df51d51bd2b2f4e4ac7f5008c5d79dce61a7f16149f2be64e27541"
    },
    {
      "id": "TLS-08",
      "component": "TLS",
      "status": "PASS",
      "evidenceDigest": "8d6ab2d30d16d77ac8e2756f528ae91735993550b17ea4b59f755e31b08e17a6"
    },
    {
      "id": "WEB-01",
      "component": "Public HTTP",
      "status": "PASS",
      "evidenceDigest": "c78d6af207f1622c605b933b12d6cf45f104f0c25db5c8468c785e3d07c2a5df"
    },
    {
      "id": "WEB-02",
      "component": "Public HTTP",
      "status": "PASS",
      "evidenceDigest": "c78d6af207f1622c605b933b12d6cf45f104f0c25db5c8468c785e3d07c2a5df"
    },
    {
      "id": "WEB-03",
      "component": "Public HTTP",
      "status": "PASS",
      "evidenceDigest": "c78d6af207f1622c605b933b12d6cf45f104f0c25db5c8468c785e3d07c2a5df"
    },
    {
      "id": "WEB-04",
      "component": "Public HTTP",
      "status": "PASS",
      "evidenceDigest": "c78d6af207f1622c605b933b12d6cf45f104f0c25db5c8468c785e3d07c2a5df"
    },
    {
      "id": "WEB-05",
      "component": "Public HTTP",
      "status": "PASS",
      "evidenceDigest": "c78d6af207f1622c605b933b12d6cf45f104f0c25db5c8468c785e3d07c2a5df"
    },
    {
      "id": "WEB-06",
      "component": "Public HTTP",
      "status": "PASS",
      "evidenceDigest": "c78d6af207f1622c605b933b12d6cf45f104f0c25db5c8468c785e3d07c2a5df"
    },
    {
      "id": "RN-SRP-INTEROP",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "7ddb91ca731e204abff4660704d849749555a9d8ece714607773920d3fdd8fcc"
    },
    {
      "id": "RN-CRYPTO-INTEROP",
      "component": "Native source / Node adapter",
      "status": "NOT TESTED",
      "evidenceDigest": "4f7ee31406fd0cf975e444c7621cfabbfe82d4e0877819ace46c66469e5366e0"
    },
    {
      "id": "RN-RATCHET-INTEROP",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "fa7f9fe404d385a27c0eedfb2c1a700dac11adbd6cc480b1e53d7e9b745ea0e5"
    },
    {
      "id": "RN-LOCAL-VAULT",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "6d80d9f3eee03b91e527c2917fe6dcc3df241c5de6ed6618e2dc38bacd11c619"
    },
    {
      "id": "RN-BROWSER-VAULT",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "4aec3406545bf5bad6cca2f02b3211fe73acff7ba48186d9823004aed01afe04"
    },
    {
      "id": "RN-PEER-IDENTITY",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "25f9be8c0bdb8bd50e843e28a26152029dd33aacfbae0437e2e44d894bd62d22"
    },
    {
      "id": "RN-DIRECTORY-AUDIT",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "64aa83df3b92b36938ee36178724020bf2d47c8480423a7425fc3906ba6720a8"
    },
    {
      "id": "RN-SESSION-MANAGER",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "9aade6678b48f4275223afd146d68e274a25188ae79552c2ac326fd346ca97bb"
    },
    {
      "id": "RN-PEER-VERIFICATION",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "8f7dacd88af885b667437a2a696c0b0357c67b1bd956e10ed796288db142abaf"
    },
    {
      "id": "RN-PREKEY-SERVICE",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "116515012c90745036beaf63d6443da2d56c3592979186acf1c79aed8c033375"
    },
    {
      "id": "RN-OUTBOX",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "4083ecb6b697ec8e7b83acf2f4743b8a3c3ebeb68538e009380714f299f7f31a"
    },
    {
      "id": "RN-AUTH-FLOWS",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "f18c5547431546208952c1c6eb9f331df07cb904affce9acd5ce1166864f0481"
    },
    {
      "id": "RN-ENCRYPTION-SETUP",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "da110aad7ef872d67339e93dc9ca1959b30c607763257d5be00b43635e0d0b2a"
    },
    {
      "id": "RN-IDENTITY-HYDRATION",
      "component": "Native source / Node adapter",
      "status": "PASS",
      "evidenceDigest": "f9c3fec7bc3455749c4fecd0dcd5d171973675f8969188079822db9f1f958944"
    },
    {
      "id": "APK-01",
      "component": "Android release",
      "status": "PASS",
      "evidenceDigest": "beee2c403c6701a8e21983c5bdce4de2c99069095500bc9c252e3160d5bf8f9d"
    },
    {
      "id": "APK-02",
      "component": "Android release",
      "status": "PASS",
      "evidenceDigest": "b0a1af67205efcd284e5bbae691ebf4a0d296b4fcae02cd28e7e0509d0e0efbc"
    },
    {
      "id": "APK-03",
      "component": "Android release",
      "status": "PASS",
      "evidenceDigest": "c4fa1faaf422116cb1843fa171c7ef7c7585847bb54318823a76b56a73a2961b"
    },
    {
      "id": "APK-04",
      "component": "Android release",
      "status": "PASS",
      "evidenceDigest": "c4fa1faaf422116cb1843fa171c7ef7c7585847bb54318823a76b56a73a2961b"
    },
    {
      "id": "APK-05",
      "component": "Android release",
      "status": "PASS",
      "evidenceDigest": "c4fa1faaf422116cb1843fa171c7ef7c7585847bb54318823a76b56a73a2961b"
    },
    {
      "id": "INFRA-01",
      "component": "Database",
      "status": "FAIL",
      "evidenceDigest": "f0e937d1a449eaebc5fb48a4eec7d4bd586a6200bb6d172a90a902098198233a"
    },
    {
      "id": "INFRA-02",
      "component": "Nginx",
      "status": "PASS",
      "evidenceDigest": "6ec629c981137fc906373486ebdb3fd5a36da86d063984c7485b7a02ee649c92"
    },
    {
      "id": "SUPPLY-01",
      "component": "Dependencies",
      "status": "FAIL",
      "evidenceDigest": "bbc461d51ef32fcba142b0946c76af6b3f8c440e3c3d38b83ec969b1c44c0d4c"
    },
    {
      "id": "STATIC-01",
      "component": "Source analysis",
      "status": "NOT TESTED",
      "evidenceDigest": "35eedc5ddc60292a241442b159d8410a708f0af83e81fc36bc53f9b3e0b2626c"
    },
    {
      "id": "SECRETS-01",
      "component": "Source secrets",
      "status": "NOT TESTED",
      "evidenceDigest": "a13b11a51a7bd717e853cb6ac0f559bc59e5c0b92afbdc7abd719c64ada75926"
    },
    {
      "id": "DAST-01",
      "component": "Public web",
      "status": "PASS",
      "evidenceDigest": "f83dee0fe19e65694bedcf1d010b0412db6aa7984d07fd1183cee68db0a7cd0a"
    },
    {
      "id": "EXTENDED-01",
      "component": "Broad regressions",
      "status": "FAIL",
      "evidenceDigest": "d1265a617186ba86f1d2c1720dea487b9bc5973b09c73605c8a2140b27b1cce1"
    },
    {
      "id": "GAP-01",
      "component": "Cryptography",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-02",
      "component": "Cryptography",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-03",
      "component": "Cloudflare",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-04",
      "component": "Infrastructure",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-05",
      "component": "Backups",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-06",
      "component": "Monitoring",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-07",
      "component": "Android",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-08",
      "component": "Android",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-09",
      "component": "Android",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-10",
      "component": "Production authentication",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-11",
      "component": "Browser",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-12",
      "component": "Abuse",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-13",
      "component": "Native source",
      "status": "NOT TESTED",
      "evidenceDigest": null
    },
    {
      "id": "GAP-14",
      "component": "Standards",
      "status": "NOT TESTED",
      "evidenceDigest": null
    }
  ],
  "limitations": [
    "No independent audit, certification, full protocol proof, or guarantee of future safety.",
    "Assessment target is a dirty working tree plus separately identified production artifacts. Base commit alone does not identify assessed source.",
    "Public result counts include selected cases and explicitly scoped manual checks; not ASVS requirement compliance.",
    "Raw scans, fixtures, payloads, environment values and customer data are excluded from public output.",
    "Local-only source scanning. OSV and Trivy downloaded advisory databases; no source uploaded to scanning services.",
    "Production requests were bounded GETs/TLS handshakes; no exploit payloads were sent to production."
  ],
  "disclosure": "mailto:livara.org@gmail.com?subject=SECURITY"
}