#Security Stack Audit (2026-05-26)

#Current Stack (Keep)

#Identity Protection: Skip the Paid Services

Aura, LifeLock, Identity Guard are credit monitoring repackaged with marketing. Aura itself got breached via phishing in March 2026. "Dark web monitoring" scans known breach dumps. It cannot see private criminal forums where real trading happens.

#What actually protects you (free)

1. Credit freeze at all three bureaus (Equifax, Experian, TransUnion). Free. Prevents new account fraud entirely. This alone beats any paid identity service.
2. IRS Identity Protection PIN prevents tax fraud filings.
3. USPS Informed Delivery alerts on mail in your name.

Do not pay for any service claiming "comprehensive dark web coverage." It does not exist.

#Data Removal

Consumer Reports 2025 found manual opt-outs were 70% more effective than paid services. But automation saves time on the treadmill (data repopulates constantly from public records).

Recommendation: Kanary at $99/yr. Supplement with Google's "Results About You" tool (free), which now covers SSNs, government IDs, and people search results.

Reality check: there are 750+ registered US data brokers. No service covers them all. Data removal is maintenance, not a one-time fix.

#Communication

#Browser

#Password Manager

Proton Pass works inside the Proton ecosystem. Alternatives:

• KeePassXC for offline-only, zero cloud exposure, zero trust required.
• Bitwarden ($0-20/yr) for cloud sync on a budget. Open source, audited, but US jurisdiction.

#Hardware Security Keys

Recommendation: Nitrokey 3. Open firmware matters. Buy two (one backup).

#DNS (External/Mobile)

AdGuard Home covers the home network. For devices off-network:

• Quad9 (9.9.9.9) is a Swiss non-profit, threat data from 20+ partners (IBM X-Force, Abuse.ch), no logs, DoH/DoT/DoQ.
• Mullvad DNS has zero logs, content blocking. Free for everyone.

Set Quad9 as upstream in AdGuard Home for threat blocking on top of existing blocklists.

#VPN Landscape

Mullvad for maximum privacy. ProtonVPN if you want a free tier + Swiss jurisdiction. IVPN only if multi-hop or specific server locations matter.

#Email/Suite Deep Dive

#Proton Suite

• SOC 2 Type II audit (July 2025, Schellman). All services passed.
• ISO 27001 certification (May 2024).
• Mail (iOS/Android/web) audited by Securitum (Nov 2025).
• Proton Pass audited by Cure53.
• No ownership concerns in 2025-2026.
• Trade-off: integrated ecosystem is convenient but creates vendor lock-in.

#Tuta (formerly Tutanota)

• All emails encrypted by default using post-quantum TutaCrypt (hybrid: CRYSTALS-Kyber + AES-256/x25519). Future-proofed against quantum computers.
• Tuta Drive launched closed beta April 2026 with post-quantum encryption for cloud storage.
• German jurisdiction (strict privacy laws, servers in Germany).
• Includes encrypted calendar + address book.
• Fewer integrations than Proton but stronger quantum-safe posture.

#Code Review & Security Scanning for SourceHut

No major AI code review tool supports SourceHut natively. Everything runs via CLI in builds.sr.ht.

#Recommended Tools

#builds.sr.ht Configuration

# .build.yml
image: alpine/edge
packages:
  - python3
  - py3-pip
tasks:
  - security: |
      pip install semgrep trufflehog
      semgrep --config=p/security-audit --config=p/owasp-top-ten .
      trufflehog filesystem --json . | grep -c verified
      trivy fs --scanners vuln,secret .

#AI Code Review

No SourceHut-native option exists. Closest is self-hosting PR-Agent (Apache 2.0, supports bring-your-own LLM) and wiring it to builds.sr.ht via webhooks. Requires custom integration work. Alternatively, run claude CLI in a local pre-push hook for AI review before pushing.

#SAST Tool Comparison

• Semgrep: Best fit for SourceHut. CLI only, Alpine-compatible, 10-20s per scan, ~150MB memory, 3000+ community rules, custom rules look like source code. No account needed.
• CodeQL: Free for open source, paid for private repos. CLI available but slower (minutes to 30+ min, 450MB memory). Superior for complex code analysis. GitHub-native but runs anywhere.
• SonarQube/SonarCloud: Client-server model. More infrastructure overhead. Requires SonarScanner in builds.sr.ht. Free tier for public repos.

#Secret Scanning Comparison

• TruffleHog: Two-phase (entropy + regex, then real API verification). 700+ credential patterns. Recommended.
• Gitleaks: Faster pure scanning. No verification phase. Good as a complement.

#Container Scanning Comparison

• Trivy: Vulnerabilities, misconfigurations, secrets, licenses, SBOM. Comprehensive in one tool. Recommended.
• Grype: 30-40% faster for pure vulnerability matching. Narrower scope (vulnerabilities + SBOM only).

#Action Plan

#Do Today (Free)

• [ ] Credit freeze at Equifax, Experian, TransUnion
• [ ] Google "Results About You" enrollment
• [ ] IRS Identity Protection PIN
• [ ] USPS Informed Delivery
• [ ] Set Quad9 as upstream DNS in AdGuard Home

#Buy Soon

• [ ] Nitrokey 3 x2 (~$120 one-time)
• [ ] Kanary subscription ($99/yr)

#Set Up

• [ ] SimpleX for sensitive communications
• [ ] Semgrep + TruffleHog + Trivy in builds.sr.ht pipelines
• [ ] KeePassXC if moving off Proton Pass

#Evaluate Later

• [ ] Self-hosted PR-Agent for AI code review on SourceHut
• [ ] Matrix/Element on STARGATE for federated chat
• [ ] Tuta as Proton alternative (post-quantum encryption)