Security Audit — July 2026 — Round 9

Code Security Review
NetMon Roots v1.1.19 — release state

Ninth automated security review based on Claude Fable 5, performed on the final 1.1.19 release state rather than on an intermediate snapshot. This round focused on the VPN/UFW killswitch reconcile, DNS startup recovery, the in-app update check, Debian maintainer scripts, and the complete release verification chain via SHA256SUMS and minisign.

Download PDF Summary Findings Release verification

✓

0 critical — 0 high — 2 medium findings

Two medium-severity issues were confirmed, fixed, regression-tested, and re-verified on the final release build. No critical or high findings remained open in scope.

Date

July 18, 2026

Reviewed version

v1.1.19 — final release state

Critical findings

High findings

Medium findings

2 — both fixed

Release signature

validated

Scope and method

The reviewed scope was the final 1.1.19 release state, including version consistency across the application, Debian package, download pages, and release metadata. The audit concentrated on privileged or externally influenced paths with release impact.

VPN/UFW/killswitch reconcile and recovery behavior
DNS startup recovery and fallback handling
Remote update metadata and URL opening flow
Debian package maintainer scripts and install-time behavior
Release verification with SHA256SUMS and minisign

Confirmed findings

F1 — Update URL allowlist gap: the in-app update check accepted a server-provided download_url without a strict scheme/host allowlist before handing it to xdg-open. This was fixed with a web-only scheme restriction plus trusted-host pinning for the update path.

F2 — Killswitch fail-open on early VPN switch failure: early VPN slot switch error paths could reset outbound firewall policy too broadly even when the user intended killswitch protection to stay active. This was fixed with a killswitch-preserving recovery path and regression coverage.

Release verification

The release artifacts were cross-checked via sha256sum -c SHA256SUMS and verified against the shipped minisign signature and public key. The signature chain for the 1.1.19 release bundle validated successfully.

netmon_1.1.19_all.deb matched the published SHA256 sums
netmon_dokumentation_1.1.19.html and .pdf matched the published SHA256 sums
SHA256SUMS.minisig validated against the shipped minisign public key

Implemented hardening

Trusted-host and scheme checks for the automatic update URL path
Killswitch-preserving firewall recovery for early VPN switch failure paths
Regression coverage for both confirmed findings
Re-validation of the release signature chain for the final 1.1.19 bundle

Auditor: Claude Fable 5 (Anthropic) — automated multi-agent security review
Project owner: Sven Froehlich
Date: July 18, 2026
Reviewed state: final NetMon 1.1.19 release build
Method: static security review with targeted validation and regression confirmation

Download page • Updates • Documentation • Legal