Security Audit

Before moving closer to production readiness, we need to perform a comprehensive security audit of the entire codebase to identify potential vulnerabilities, misconfigurations, or unsafe patterns.

This is especially important given that:

• The application handles cryptographic operations (e.g. Diffie-Hellman, PSK generation),
• There is WebSocket communication and encryption,
• Nodes can interact over untrusted networks,
• There is potential for user-generated content and decentralized identity.

Audit Scope Should Include:

1. Cryptography:

• Validate usage of secure algorithms and key exchange.
• Ensure no use of weak or deprecated crypto primitives.

2. Memory & Binary Security: check anti-debugging, hardening flags, stripping, Go build flags.
3. Network & Transport: validate handshake mechanisms, replay protection, peer authentication.
4. Identity & Secrets: ensure proper handling and storage of private keys, salts, and tokens.
5. Input Validation: sanitize and validate incoming requests/messages across interfaces.
6. P2P Discovery & Trust: ensure nodes can’t spoof others or bypass trust mechanisms.
7. Optional: Fuzzing high-risk entry points (e.g. WebSocket handlers, import routines).

Result:

• List of discovered issues with severity levels.
• Recommendations for fixing or mitigating each issue.
• CI integration suggestions (e.g. static analysis tools, linters, SAST).

Contributors with experience in security, cryptography, or Go auditing are welcome to join or advise.