Fortify.Decidim: security audit for Decidim
To protect sensitive data in participation processes and safeguard the integrity of democratic processes, we had Decidim undergo a comprehensive security audit together with AIT Austrian Institute of Technology.
- Funding: netidee (Call 18)
- Period: 2024
- Partner: Penetration testing department of AIT Austrian Institute of Technology
- Team: Romy Grasgruber-Kerl (project lead), Alexander Rusa, Piero Chiussi
Starting point
Participation platforms sometimes process sensitive data, such as political opinions or memberships. Targeted attacks could expose such data or manipulate participation processes. Open-source software like Decidim offers many advantages thanks to its open code – but security has to be checked continuously.
What we did
- Set up a Decidim test instance as the basis for the audit
- Automated vulnerability scans and static code analysis with commercial and free tools
- In-depth manual testing of the high-risk components identified
Result
The security audit was completed in October 2024. The vulnerabilities found have been fixed in Decidim. This benefits everyone who uses Decidim – including the platforms we run for our clients. The audit report itself is confidential.
Learn more
- Project page at netidee with summary and final report
- Blog post: Fortify.Decidim
- Decidim security policy and patches on GitHub
Decidim for your organisation?
In a no-obligation conversation, we will clarify what suits your municipality or organisation.