Audits of the upstream SimpleX project, not of SeTalk

2022 — Implementation security assessment

Auditor

Trail of Bits

When

November 2022, over one week; announced with SimpleX Chat v4.2.^2,3

What was examined

the simplexmq library, which handles the cryptography and networking of SimpleX.²

What was not examined

the chat protocol implementation, the mobile app interfaces and the push notification server used by iOS clients.²

Findings

2 medium and 2 low severity issues, each requiring a high-difficulty attack. SimpleX reported three of them fixed in v4.2.²

Report

Trail of Bits publication.⁴

2024 — Cryptographic design review

Auditor

Trail of Bits

When

July 2024, announced with SimpleX v6.1.⁵

What was examined

the design of the protocols used in the SimpleX network and apps: the messaging protocol (SMP), the agent protocol, push notifications, file transfer (XFTP), remote control (XRCP) and the chat protocol.⁵

Findings

3 medium and 1 low severity findings, all requiring a high-difficulty attack, plus 3 informational findings; no critical issues. SimpleX reported three of them addressed in v6.1 and the rest accepted.⁵

SimpleX keeps its own list of security audits.³

SeTalk's own review

There has been no independent audit of SeTalk. SeTalk itself has not had an independent audit yet.

The parts SeTalk adds or changes are not covered by the SimpleX audits: the account service on setalk.app, the subscription check in the app, the rebranding of the app and the configuration of SeTalk's servers.^6,1

The app's code will be published under AGPL-3.0, together with the app, so anyone can review it, and our messaging servers run SimpleX's server code without modification.⁷ The account service on setalk.app is not public; what it keeps is listed in the account record on the home page.⁶ If you find a problem, see our security policy.