Security Reviews
How we check our own code, and what those checks have found and fixed.
In short
Island.chat's code is reviewed regularly with AI models from two companies. Confirmed problems are fixed, each with a test that proves the fix. These are our own reviews, not an independent audit. An independent audit is planned, and we will publish its report.
How reviews work
- Whole-codebase reviews look for weaknesses across the service: encryption, login, sessions, payments, safety reports and resistance to abuse.
- Every change is reviewed before release. New features and fixes are reviewed on their own, and the fixes those reviews produce are reviewed again.
- Two AI systems from different companies, Anthropic's Claude and OpenAI's GPT models, review the same code, so one model's blind spots are less likely to go unnoticed.
- Every finding must show how it fails: the input or timing that breaks something and what goes wrong. Findings are ranked by severity, and style comments don't count.
- Every fix comes with a test that fails on the old code and passes on the new, so the problem can't quietly return. Minor findings whose fix would risk more than it gains are left deliberately, with the reason recorded. The service has about 2,000 automated tests: 1,450 for the server and 590 for the app in your browser.
- Every release is checked before it goes live: a release check must pass, and it fails if any stored account or message does not match the encryption format or the configuration is unsafe. The server also refuses to start with an unsafe configuration.
What this is not
These reviews are run by the developer, not by an outside firm, so they are not an independent audit. Our source code is not public, so they can't be repeated by others. What anyone can check is the code that runs in your browser: encryption happens there, and your browser's developer tools show that messages leave your device already encrypted. The Security page explains what Island.chat does and does not protect against.
What reviews have fixed
Fixed issues only, newest first, described in general terms. Problems still being fixed are never listed.
| When | Area | What was fixed |
|---|---|---|
| Oct 2026 | Server crash | A specially crafted compressed request, sent without logging in, could crash the server, and repeating it could keep the service offline. Compressed requests are now refused, and the affected library was updated. |
| Oct 2026 | Safety numbers | Found before release: the number could be computed from a newer key than the one the open conversation uses. It is now tied to the conversation's key, with a warning if they differ. |
| Oct 2026 | Password change | A password change checked against the old password could be applied after a newer change and undo it. It is now refused. |
| Oct 2026 | Payments | A checkout opened while a renewal was charging the saved card could charge twice. It is now refused. |
| Oct 2026 | Invitations | An invitation accepted and cancelled at the same moment could end up in both states. Exactly one now wins. |
| Oct 2026 | Safety reports | Repeated reports of the same large files could fill the server's storage. Reports now have per-account and daily storage limits. |
| Oct 2026 | Dependencies | Updated libraries with published security advisories, including a crash in the real-time connection handshake and a way to spoof the client address. |
| Sep 2026 | Monitoring | Error alerts could include account identifiers. Alerts now carry only an approved list of fields. |
| Sep 2026 | Cross-site requests | Any website could make its visitors' browsers send requests to Island.chat, for example to lock their address out of logging in. Requests from other sites are now refused. |
| Sep 2026 | Accounts in two tabs | After logging into a different account in another tab, a tab could keep working with the wrong account's session. The mismatch is now detected and refused. |
| Sep 2026 | Invitations | Opening an invitation link while logged in accepted it at once. You now confirm with a click, and a crafted invitation link can no longer reach other parts of the service. |
| Sep 2026 | File downloads | Abandoned downloads could use up the server's storage connections and stall the service, including the scheduled deletion of expired messages. |
| Sep 2026 | Login | A login started with an old password could be completed for a few minutes after a password change. Logins are now tied to the current password. |
| Sep 2026 | Denial of service | Large request bodies, unlimited real-time connections and floods of error reports could slow or stop the service without logging in. Each is now limited. |
| Sep 2026 | Sessions | A session ended by logout, password change or account deletion could be restored by a request still in progress, and stay valid for hours. Ended sessions now stay ended. |
| Sep 2026 | Deleted messages | A deleted message kept its encrypted content on the server, and an edit made at the same moment as a delete could bring it back. Deletion now erases the content. |
| Sep 2026 | Passkeys | A passkey sign-in challenge could be replayed, and one endpoint revealed whether a handle exists. Challenges are now single-use and the endpoint is gone. |
| Sep 2026 | Message history | Loading older messages could reveal whether a message existed elsewhere and roughly when it was sent. Lookups are now limited to your own conversation. |
| Sep 2026 | Rate limits | Visitors on IPv6 could change address to avoid rate limits. Limits now cover the whole address block. |
| Jun 2026 | Destructive actions | Deleting your account or removing a contact needed only an open session. Both now ask for your password, and password guesses there are limited. |
| Jun 2026 | Key storage | Private keys moved to a new stored format whose key comes from the password login itself. The older format and its login path were removed. |
| Jun 2026 | Crypto payments | An underpaid crypto payment could still grant access. Access now needs the full amount. |
| May 2026 | Free trial | A gap in the trial limits allowed unlimited free messages. It is closed. |
Found a problem?
Email security@island.chat. Our security.txt has the details. We reply to every report, fix confirmed issues first, and credit you here if you want.