# Security Stack Audit (2026-05-26)

## Current Stack (Keep)

| Tool | Verdict |
|------|---------|
| Mullvad VPN | Gold standard. Six consecutive clean audits through 2026. No incidents. Keep. |
| Proton Suite | SOC 2 Type II (July 2025), ISO 27001, all apps audited by Securitum/Cure53. Solid ecosystem. Keep. |
| AdGuard Home | Good for network-wide blocking. Add Quad9 (9.9.9.9) as upstream DNS for malware-feed threat blocking. |

---

## Identity Protection: Skip the Paid Services

Aura, LifeLock, Identity Guard are credit monitoring repackaged with marketing. Aura itself got breached via phishing in March 2026. "Dark web monitoring" scans known breach dumps. It cannot see private criminal forums where real trading happens.

### What actually protects you (free)

1. **Credit freeze at all three bureaus** (Equifax, Experian, TransUnion). Free. Prevents new account fraud entirely. This alone beats any paid identity service.
2. **IRS Identity Protection PIN** prevents tax fraud filings.
3. **USPS Informed Delivery** alerts on mail in your name.

Do not pay for any service claiming "comprehensive dark web coverage." It does not exist.

---

## Data Removal

Consumer Reports 2025 found manual opt-outs were 70% more effective than paid services. But automation saves time on the treadmill (data repopulates constantly from public records).

| Service | Price | Coverage | Notes |
|---------|-------|----------|-------|
| Kanary | $99/yr | 1000+ sites | Best value. Uses CCPA/GDPR legal frameworks to force compliance. |
| Optery | $249/yr | 270+ brokers | Verification screenshots, broader automation. |
| DeleteMe | $249/yr | 750+ brokers | Human-assisted. Expensive for what it does. |

**Recommendation:** Kanary at $99/yr. Supplement with Google's "Results About You" tool (free), which now covers SSNs, government IDs, and people search results.

Reality check: there are 750+ registered US data brokers. No service covers them all. Data removal is maintenance, not a one-time fix.

---

## Communication

| Tool | Use Case | Notes |
|------|----------|-------|
| Signal | Default messaging | Post-quantum ratchet (SPQR with ML-KEM) added 2025. Still requires phone number. |
| SimpleX | Anonymous comms | No identifiers at all. Servers cannot see who talks to whom. Matured significantly in 2026. |
| Matrix/Element | Self-hosted team chat | Federation + bridges to IRC/Slack/Discord. Can self-host on STARGATE. |

---

## Browser

| Browser | Use Case |
|---------|----------|
| LibreWolf | Daily driver. Hardened Firefox, all telemetry stripped. |
| Mullvad Browser | Fingerprint resistance without onion routing. Use when needed. |
| Tor Browser | Actual anonymity. Already running Tor services. |

---

## Password Manager

Proton Pass works inside the Proton ecosystem. Alternatives:

- **KeePassXC** for offline-only, zero cloud exposure, zero trust required.
- **Bitwarden** ($0-20/yr) for cloud sync on a budget. Open source, audited, but US jurisdiction.

---

## Hardware Security Keys

| Key | Price | Why |
|-----|-------|-----|
| Nitrokey 3 | $59 | Open-source firmware, Common Criteria EAL 6+, full protocol support (FIDO2/OTP/PIV/OpenPGP). Auditable hardware. |
| Google Titan | ~$30 | 250+ passkey capacity, cheapest solid option. No OTP/PIV. |
| SoloKeys Solo 2 | $35-46 | Open-source, affordable. FIDO2 only. |

**Recommendation:** Nitrokey 3. Open firmware matters. Buy two (one backup).

---

## DNS (External/Mobile)

AdGuard Home covers the home network. For devices off-network:

- **Quad9** (9.9.9.9) is a Swiss non-profit, threat data from 20+ partners (IBM X-Force, Abuse.ch), no logs, DoH/DoT/DoQ.
- **Mullvad DNS** has zero logs, content blocking. Free for everyone.

Set Quad9 as upstream in AdGuard Home for threat blocking on top of existing blocklists.

---

## VPN Landscape

| Provider | Notes |
|----------|-------|
| Mullvad | Six consecutive clean audits. Web app audit (Oct 2025, Assured), payment API audit (Jan 2026, X41 D-Sec), GotaTun WireGuard audit (Mar 2026), Android MASA audit (Mar 2025, NCC Group). No critical vulnerabilities found in any. |
| IVPN | Six-year audit streak with Cure53. Fully open-source, single founder with disclosed 100% ownership. $6/month, 2 devices on Standard. |
| ProtonVPN | Swiss jurisdiction, four consecutive annual audits, zero-knowledge architecture verified by Securitum. Free tier with unlimited data. |

Mullvad for maximum privacy. ProtonVPN if you want a free tier + Swiss jurisdiction. IVPN only if multi-hop or specific server locations matter.

---

## Email/Suite Deep Dive

### Proton Suite

- SOC 2 Type II audit (July 2025, Schellman). All services passed.
- ISO 27001 certification (May 2024).
- Mail (iOS/Android/web) audited by Securitum (Nov 2025).
- Proton Pass audited by Cure53.
- No ownership concerns in 2025-2026.
- Trade-off: integrated ecosystem is convenient but creates vendor lock-in.

### Tuta (formerly Tutanota)

- All emails encrypted by default using post-quantum TutaCrypt (hybrid: CRYSTALS-Kyber + AES-256/x25519). Future-proofed against quantum computers.
- Tuta Drive launched closed beta April 2026 with post-quantum encryption for cloud storage.
- German jurisdiction (strict privacy laws, servers in Germany).
- Includes encrypted calendar + address book.
- Fewer integrations than Proton but stronger quantum-safe posture.

---

## Code Review & Security Scanning for SourceHut

No major AI code review tool supports SourceHut natively. Everything runs via CLI in builds.sr.ht.

### Recommended Tools

| Tool | Purpose | Cost |
|------|---------|------|
| Semgrep | SAST (static analysis) | Free, 3000+ rules, 10-20s scans |
| TruffleHog | Secret scanning | Free, 700+ patterns, verifies live credentials |
| Trivy | Container + dependency + secret scanning | Free, single binary |
| Gitleaks | Fast secret scanning (lighter than TruffleHog) | Free |
| Snyk CLI | Dependency vulnerability scanning | Free tier |

### builds.sr.ht Configuration

```yaml
# .build.yml
image: alpine/edge
packages:
  - python3
  - py3-pip
tasks:
  - security: |
      pip install semgrep trufflehog
      semgrep --config=p/security-audit --config=p/owasp-top-ten .
      trufflehog filesystem --json . | grep -c verified
      trivy fs --scanners vuln,secret .
```

### AI Code Review

No SourceHut-native option exists. Closest is self-hosting PR-Agent (Apache 2.0, supports bring-your-own LLM) and wiring it to builds.sr.ht via webhooks. Requires custom integration work. Alternatively, run `claude` CLI in a local pre-push hook for AI review before pushing.

### SAST Tool Comparison

- **Semgrep**: Best fit for SourceHut. CLI only, Alpine-compatible, 10-20s per scan, ~150MB memory, 3000+ community rules, custom rules look like source code. No account needed.
- **CodeQL**: Free for open source, paid for private repos. CLI available but slower (minutes to 30+ min, 450MB memory). Superior for complex code analysis. GitHub-native but runs anywhere.
- **SonarQube/SonarCloud**: Client-server model. More infrastructure overhead. Requires SonarScanner in builds.sr.ht. Free tier for public repos.

### Secret Scanning Comparison

- **TruffleHog**: Two-phase (entropy + regex, then real API verification). 700+ credential patterns. Recommended.
- **Gitleaks**: Faster pure scanning. No verification phase. Good as a complement.

### Container Scanning Comparison

- **Trivy**: Vulnerabilities, misconfigurations, secrets, licenses, SBOM. Comprehensive in one tool. Recommended.
- **Grype**: 30-40% faster for pure vulnerability matching. Narrower scope (vulnerabilities + SBOM only).

---

## Action Plan

### Do Today (Free)

- [ ] Credit freeze at Equifax, Experian, TransUnion
- [ ] Google "Results About You" enrollment
- [ ] IRS Identity Protection PIN
- [ ] USPS Informed Delivery
- [ ] Set Quad9 as upstream DNS in AdGuard Home

### Buy Soon

- [ ] Nitrokey 3 x2 (~$120 one-time)
- [ ] Kanary subscription ($99/yr)

### Set Up

- [ ] SimpleX for sensitive communications
- [ ] Semgrep + TruffleHog + Trivy in builds.sr.ht pipelines
- [ ] KeePassXC if moving off Proton Pass

### Evaluate Later

- [ ] Self-hosted PR-Agent for AI code review on SourceHut
- [ ] Matrix/Element on STARGATE for federated chat
- [ ] Tuta as Proton alternative (post-quantum encryption)