@kazani: Mullvad VPN passes X41 D-Sec security audit with no critical flaws

Mullvad VPN published a new security audit report by the German firm X41 D-Sec, which found no critical flaws or risks to user privacy. The white-box audit covered backend services for accounts and payments, including the public API, authentication, device registration, payment processing, and WireGuard key distribution. It identified 3 medium-severity issues, which Mullvad fixed during the audit, and the auditors also recommended strengthening mutual TLS configuration, cryptographic signatures in VPN relays, and concurrency management. The audit noted Mullvad's minimalist data management, including separation of user identities from VPN keys and regular key rotation.