How We Audit Tools for Human Rights Defenders

November 5, 2025 · audits, methodology, human-rights

Subgraph is an approved supplier to the Open Technology Fund Security Lab. Through the Lab we audit software used by journalists, activists, and human rights defenders. This post describes how we run those audits.

The code we review is similar to code anywhere else. It uses the same authentication protocols, parsers and cryptographic libraries. The difference is the threat model.

Threat model

We start each audit by building a threat model with the developers. For most Lab projects the adversary is a state actor with significant resources. Users may face arrest if they are identified. We record the assumptions that follow from this:

  • The device may be seized. We check every secret the app stores, and every secret it should store but does not, against physical access by an adversary.
  • The network is hostile. We test against rogue certificates, DNS manipulation and captive portals.
  • Possession of the app can be incriminating. We look for anything on the device that reveals the app is installed or has been used.

Review and testing

We review the source code manually. We also run the software and test it directly: intercepting traffic, inspecting storage, and attempting the attacks identified in the threat model. At each layer we ask:

  1. What data reaches the device, and what can it do there?
  2. Can an attacker without credentials influence execution?
  3. When something fails, does it fail safely?
  4. Does each security claim in the design hold up? We check that encryption is applied where the documentation says it is, and that protected storage cannot be reached through a debug interface.

Reporting and retesting

Each finding in our report includes:

  • Reproduction steps. The conditions that trigger the issue, and how to confirm a fix.
  • A severity rating. We rate by exploitability in the project’s threat model, and we note when lower severity issues can be chained.
  • A recommended fix. We identify the design or code decision behind the issue and propose a specific change where we can.

After the developers fix the issues, we retest and update the report.

Published reports

Some of our reports are public, including Tella, NetAidKit and FileZilla. Other researchers can read and check the findings.

Subgraph also created the Vega web vulnerability scanner. If you maintain a project used by people at risk and need an audit, see our services page.