Security audit firms
Cure53 privacy rating
Our pick
Berlin security firm that performs penetration tests and source code audits of web, mobile, browser, VPN and cryptographic software, and publishes many client reports.
Summary
Cure53 scores 100 out of 100 (grade A) on the security audit firms criteria. It meets 4 of 4 criteria: publishes full reports, audits open-source projects, public research and no trackers on website. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.
Score 100 out of 100. How scoring works
Criteria
-
Yes
Publishes full reports Weight 3 of 3
Are full audit reports routinely published, with client consent, rather than only summaries or badges?
The publications section links many full client reports as PDFs.
-
Yes
Audits open-source projects Weight 2 of 3
Does the firm regularly audit open-source software and non-profit projects?
Published reports cover many open-source projects, such as Psiphon, Mullvad VPN and KeePassium.
-
Yes
Public research Weight 1 of 3
Does the firm publish security research, advisories or tools?
Maintains the open-source DOMPurify sanitizer and publishes research papers on browser and web security.
-
Yes
No trackers on website Weight 1 of 3
Is the firm's website free of third-party trackers?
The privacy policy states the site uses no cookies and no user analytics, and the tracker test found none.