Colitu Security Assessment Report

0At a glance

A summary of the results as of the report date. For the safety of our users, the technical details of open findings are not included in this edition.

1Executive summary

The control-plane API, web portal, administration interface, AI-assisted assistants, business (Business) console, support and e-mail channel, community bots, browser extension, and Android and iOS apps that make up the Colitu service were assessed on 25 October 2026 against the OWASP Application Security Verification Standard (ASVS) 5.0 and the OWASP Mobile Application Security Verification Standard (MASVS) v2.1.

The assessment found no open findings of critical, high or medium severity. Of the 23 open findings, 4 are low severity and 19 are informational, and all of them have been added to the remediation plan.

Each of the 253 requirements at ASVS 5.0 Level 1 and Level 2 was assessed individually with evidence (Appendix A). Of the 200 applicable requirements, 138 are fully met and 51 are partially met; 7 requirements are not met and 4 cannot be verified by static review. Most of the requirements that are not met concern documentation, security logging and hardening. On the basis of these results, the service does not claim full compliance with ASVS 5.0 Level 2.

Under MASVS, both mobile platforms fully meet the cryptography, authentication and code quality groups, and largely meet the storage, network, platform interaction and privacy groups.

2Scope

The assessment was carried out on the source code and configuration of the following components as of 25 October 2026.

Areas left out of scope: the Windows and Linux desktop apps (subject to separate assessments), the VPN server infrastructure, the systems of third-party payment and AI providers, physical security and social engineering.

3Method and limitations

The following methods were applied in the assessment:

• Manual and tool-assisted static review of the source code against the ASVS verification requirements, the MASTG test cases and the OWASP Top 10 for LLM Applications 2025.
• A checklist for each of the 253 requirements at ASVS 5.0 Level 1 and Level 2, evidenced by source code locations (Appendix A).
• Scanning of dependencies for known vulnerabilities (govulncheck for Go, npm audit for JavaScript).
• Configuration review: security headers, content security policy, TLS, cross-origin resource sharing (CORS), container privileges and mobile platform manifests.
• Independent re-verification of the findings in a second review round; false positives were removed and severities were set on the basis of this round.

Limitations:

• No dynamic testing (DAST) or penetration testing was performed against live systems.
• The mobile apps were not dynamically tested on a device.
• This work is an internal assessment carried out by Colitu; it is not a substitute for an independent third-party audit or certification.

4Rating criteria

5OWASP ASVS 5.0 compliance assessment

The 253 requirements at ASVS 5.0 Level 1 and Level 2 were assessed individually. The table below shows the results by chapter; the status at requirement level is in Appendix A.

V10 is largely not applicable because the service acts only as a server-to-server service-account client, and V17 because WebRTC is not used at all. The “Partial” status also covers cases where the requirement is essentially met but a supplementary element (documentation, logging, a limit value, etc.) is missing.

6OWASP MASVS v2.1 compliance assessment

The Android and iOS apps were assessed against the eight control groups of MASVS v2.1, on the basis of the MASTG test cases.

7Summary of open findings

As of the report date there are 23 open findings; there are no open findings of critical, high or medium severity. Of the 4 low-severity findings, fixes for 3 are ready and being rolled out (the database access role, export of security logs off the server, and virus scanning of attachments). One, the possibility of inflating anonymous app statistics, has been closed with a documented risk acceptance because it contains no personal data and affects only the accuracy of statistics.

For the safety of our users, the technical details of open findings are not included in this public edition. The findings have been added to the remediation plan with the following target timelines:

8Verified security controls

During the assessment, the following controls were verified as implemented in the source code.

9Conclusion and statement

There are no open findings of critical, high or medium severity in the components assessed. The OWASP ASVS 5.0 Level 2 requirements are met to a significant extent, but full compliance requires improvements in documentation, security logging and hardening. Under OWASP MASVS v2.1, the mobile apps meet the critical control groups. The open findings will be resolved according to the timeline above.

This report does not include findings that were identified during the assessment and resolved before the report date. The assessment is repeated periodically; each new report replaces the previous one.

AAppendix A — OWASP ASVS 5.0 Level 1–2 checklist

Each of the 253 requirements at Level 1 and Level 2 was assessed individually. The evidence (source code locations) is kept in internal records. The subsection names are the original English names from ASVS.