Audits¶
An audit is limited by its date, version, commits, components and exclusions. Corrections and retests must be distinguished from initial findings. Public source code is not proof that installed binaries match it. An advisory about availability is not automatically a break of content encryption.
| Messenger | Audits | Main weakness |
|---|---|---|
| Signal | AuditsProtocols and AKV examined under distinct scopes; not the whole infrastructure or every binary. [1] [2] [3] | Main weaknessMandatory number known to the provider and telecom layer. [1] [2] |
| SimpleX | AuditsTrail of Bits 2022 and 2024 protocol review; announced 2026 review had no usable public report at the research cutoff. [1] [2] [3] | Main weaknessMore multi-device friction; relays and notifications require care. [1] [2] |
| Olvid | AuditsHistorical CSPN/Synacktiv work and 2026 formal analysis; distinct scopes and versions. [1] [2] [3] | Main weaknessNo network anonymity; calls and multi-device require a licence. [1] [2] |
| Session | AuditsQuarkslab 2021 and WOOT 2026 cover different scopes / versions. [1] [2] [3] | Main weaknessProtocol V1 attacks and unknown fix / retest status; calls expose IP. [1] [2] |
| Threema | AuditsCure53 and Ibex analyses: distinct scopes; desktop retest status needs verification. [1] [2] [3] | Main weaknessDesktop beta limits, account data and linkable purchases. [1] [2] |
| Cwtch | AuditsUnknown: not established for the version and configuration in question. | Main weaknessNo iOS; niche ecosystem and more limited assurance. [1] [2] |
| Briar | AuditsCure53 and ROS/OTF: bounded dates, versions and retests in the register. [1] [2] [3] | Main weaknessNo iOS or calls; essential maintenance since July 2026. [1] [2] |
Wire iOS CVE-2026-35049 affected clients before 4.16.0 and described crashes / loops from malformed Proteus data, with a fix reported in 4.16.0. Discord DAVE audits concern eligible audio/video, not text. Delta Chat audits have distinct Webxdc, client and SecureJoin/Autocrypt scopes. WhatsApp Private Processing audits do not audit the entire messenger.
The detailed evidence is maintained in the French Phase 2 register. The translation is a restatement, not new evidence.