{"id":3699,"date":"2026-10-20T10:07:05","date_gmt":"2026-10-20T08:07:05","guid":{"rendered":"https:\/\/partizipationsbuero.at\/?page_id=3699"},"modified":"2026-10-20T14:15:22","modified_gmt":"2026-10-20T12:15:22","slug":"projekt-fortify-decidim","status":"publish","type":"page","link":"https:\/\/partizipationsbuero.at\/en\/projekt-fortify-decidim\/","title":{"rendered":"Fortify.Decidim \u2013 Sicherheitsaudit f\u00fcr Decidim"},"content":{"rendered":"<div class=\"wp-block-group alignfull pb-sec has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"pb-meta wp-block-paragraph\">Security \u00b7 netidee \u00b7 2024<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Fortify.Decidim: security audit for Decidim<\/h1>\n\n\n\n<p class=\"pb-lead wp-block-paragraph\">To protect sensitive data in participation processes and safeguard the integrity of democratic processes, we had Decidim undergo a comprehensive security audit together with AIT Austrian Institute of Technology.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Funding:<\/strong> netidee (Call 18)<\/li>\n\n\n\n<li><strong>Period:<\/strong> 2024<\/li>\n\n\n\n<li><strong>Partner:<\/strong> Penetration testing department of AIT Austrian Institute of Technology<\/li>\n\n\n\n<li><strong>Team:<\/strong> Romy Grasgruber-Kerl (project lead), Alexander Rusa, Piero Chiussi<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Starting point<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Participation platforms sometimes process sensitive data, such as political opinions or memberships. Targeted attacks could expose such data or manipulate participation processes. Open-source software like Decidim offers many advantages thanks to its open code \u2013 but security has to be checked continuously.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What we did<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set up a Decidim test instance as the basis for the audit<\/li>\n\n\n\n<li>Automated vulnerability scans and static code analysis with commercial and free tools<\/li>\n\n\n\n<li>In-depth manual testing of the high-risk components identified<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Result<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The security audit was completed in October 2024. The vulnerabilities found have been fixed in Decidim. This benefits everyone who uses Decidim \u2013 including the platforms we run for our clients. The audit report itself is confidential.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Learn more<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.netidee.at\/fortifydecidim\">Project page at netidee<\/a> with summary and final report<\/li>\n\n\n\n<li><a href=\"\/en\/fortify-decidim\/\">Blog post: Fortify.Decidim<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/decidim\/decidim\/security\">Decidim security policy and patches on GitHub<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"pb-small wp-block-paragraph\"><a href=\"\/en\/referenzen\/\">\u2190 All references and projects<\/a><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull pb-sec pb-cta has-accent-5-background-color has-background has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading has-text-align-center\">Decidim for your organisation?<\/h2>\n\n\n\n<p class=\"has-text-align-center wp-block-paragraph\">In a no-obligation conversation, we will clarify what suits your municipality or organisation.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-35f06ea7 wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"\/en\/terminbuchung-2\/\">Book an initial consultation<\/a><\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Sicherheit \u00b7 netidee \u00b7 2024 Fortify.Decidim: Sicherheitsaudit f\u00fcr Decidim Damit sensible Daten in Beteiligungsprozessen gesch\u00fctzt sind und die Integrit\u00e4t demokratischer Prozesse gewahrt bleibt, haben wir Decidim gemeinsam mit dem AIT Austrian Institute of Technology einem umfassenden Sicherheitsaudit unterzogen. Ausgangslage Beteiligungsplattformen verarbeiten mitunter sensible Daten, etwa politische Meinungen oder Mitgliedschaften. Gezielte Angriffe k\u00f6nnten solche Daten offenlegen [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-no-title","meta":{"footnotes":""},"class_list":["post-3699","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Fortify.Decidim \u2013 Sicherheitsaudit f\u00fcr Decidim - Partizipationsb\u00fcro<\/title>\n<meta name=\"description\" content=\"Fortify.Decidim: Sicherheitsaudit der Beteiligungsplattform Decidim gemeinsam mit dem AIT, gef\u00f6rdert von netidee. Die gefundenen Schwachstellen wurden behoben.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/partizipationsbuero.at\/en\/projekt-fortify-decidim\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fortify.Decidim \u2013 Sicherheitsaudit f\u00fcr Decidim - Partizipationsb\u00fcro\" \/>\n<meta property=\"og:description\" content=\"Fortify.Decidim: Sicherheitsaudit der Beteiligungsplattform Decidim gemeinsam mit dem AIT, gef\u00f6rdert von netidee. Die gefundenen Schwachstellen wurden behoben.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/partizipationsbuero.at\/en\/projekt-fortify-decidim\/\" \/>\n<meta property=\"og:site_name\" content=\"Partizipationsb\u00fcro\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-20T12:15:22+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/partizipationsbuero.at\\\/projekt-fortify-decidim\\\/\",\"url\":\"https:\\\/\\\/partizipationsbuero.at\\\/projekt-fortify-decidim\\\/\",\"name\":\"Fortify.Decidim \u2013 Sicherheitsaudit f\u00fcr Decidim - Partizipationsb\u00fcro\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/partizipationsbuero.at\\\/#website\"},\"datePublished\":\"2026-10-20T08:07:05+00:00\",\"dateModified\":\"2026-10-20T12:15:22+00:00\",\"description\":\"Fortify.Decidim: Sicherheitsaudit der Beteiligungsplattform Decidim gemeinsam mit dem AIT, gef\u00f6rdert von netidee. Die gefundenen Schwachstellen wurden behoben.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/partizipationsbuero.at\\\/projekt-fortify-decidim\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/partizipationsbuero.at\\\/projekt-fortify-decidim\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/partizipationsbuero.at\\\/projekt-fortify-decidim\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/partizipationsbuero.at\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Fortify.Decidim \u2013 Sicherheitsaudit f\u00fcr Decidim\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/partizipationsbuero.at\\\/#website\",\"url\":\"https:\\\/\\\/partizipationsbuero.at\\\/\",\"name\":\"mitgestalten - Partizipationsb\u00fcro\",\"description\":\"L\u00f6sungen f\u00fcr B\u00fcrger:innenbeteiligung\",\"publisher\":{\"@id\":\"https:\\\/\\\/partizipationsbuero.at\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/partizipationsbuero.at\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/partizipationsbuero.at\\\/#organization\",\"name\":\"mitgestalten Partizipationsb\u00fcro\",\"url\":\"https:\\\/\\\/partizipationsbuero.at\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/partizipationsbuero.at\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/partizipationsbuero.at\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/cropped-cropped-cropped-Bildschirmfoto-2021-08-31-um-08.26.25.png\",\"contentUrl\":\"https:\\\/\\\/partizipationsbuero.at\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/cropped-cropped-cropped-Bildschirmfoto-2021-08-31-um-08.26.25.png\",\"width\":1016,\"height\":254,\"caption\":\"mitgestalten Partizipationsb\u00fcro\"},\"image\":{\"@id\":\"https:\\\/\\\/partizipationsbuero.at\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/80329013\\\/\",\"https:\\\/\\\/github.com\\\/DecidimAustria\"],\"legalName\":\"Grithouse GmbH\",\"description\":\"Das mitgestalten Partizipationsb\u00fcro richtet digitale Beteiligungsplattformen auf Basis der Open-Source-Software Decidim ein, hostet sie auf Servern in Deutschland und betreut sie \u2013 f\u00fcr St\u00e4dte, Gemeinden, Ministerien und Organisationen im gesamten deutschsprachigen Raum (\u00d6sterreich, Deutschland, Schweiz, Liechtenstein, S\u00fcdtirol) und international.\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"c\\\/o Impact Hub Vienna, Lindengasse 56\\\/18-19\",\"postalCode\":\"1070\",\"addressLocality\":\"Wien\",\"addressCountry\":\"AT\"},\"telephone\":\"+43 650 5234835\",\"vatID\":\"ATU77362015\",\"areaServed\":[{\"@type\":\"Country\",\"name\":\"\u00d6sterreich\"},{\"@type\":\"Country\",\"name\":\"Deutschland\"},{\"@type\":\"Country\",\"name\":\"Schweiz\"},{\"@type\":\"Country\",\"name\":\"Liechtenstein\"},{\"@type\":\"Place\",\"name\":\"S\u00fcdtirol\"},{\"@type\":\"Place\",\"name\":\"Europ\u00e4ische Union\"},{\"@type\":\"Place\",\"name\":\"International\"}],\"knowsAbout\":[\"Decidim\",\"Digitale B\u00fcrgerbeteiligung\",\"E-Partizipation\",\"B\u00fcrgerhaushalt \\\/ Partizipatives Budget\",\"Open-Source-Software f\u00fcr Verwaltungen\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Fortify.Decidim \u2013 Sicherheitsaudit f\u00fcr Decidim - Partizipationsb\u00fcro","description":"Fortify.Decidim: Sicherheitsaudit der Beteiligungsplattform Decidim gemeinsam mit dem AIT, gef\u00f6rdert von netidee. Die gefundenen Schwachstellen wurden behoben.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/partizipationsbuero.at\/en\/projekt-fortify-decidim\/","og_locale":"en_GB","og_type":"article","og_title":"Fortify.Decidim \u2013 Sicherheitsaudit f\u00fcr Decidim - Partizipationsb\u00fcro","og_description":"Fortify.Decidim: Sicherheitsaudit der Beteiligungsplattform Decidim gemeinsam mit dem AIT, gef\u00f6rdert von netidee. Die gefundenen Schwachstellen wurden behoben.","og_url":"https:\/\/partizipationsbuero.at\/en\/projekt-fortify-decidim\/","og_site_name":"Partizipationsb\u00fcro","article_modified_time":"2026-10-20T12:15:22+00:00","twitter_card":"summary_large_image","twitter_misc":{"Estimated reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/partizipationsbuero.at\/projekt-fortify-decidim\/","url":"https:\/\/partizipationsbuero.at\/projekt-fortify-decidim\/","name":"Fortify.Decidim \u2013 Sicherheitsaudit f\u00fcr Decidim - Partizipationsb\u00fcro","isPartOf":{"@id":"https:\/\/partizipationsbuero.at\/#website"},"datePublished":"2026-10-20T08:07:05+00:00","dateModified":"2026-10-20T12:15:22+00:00","description":"Fortify.Decidim: Sicherheitsaudit der Beteiligungsplattform Decidim gemeinsam mit dem AIT, gef\u00f6rdert von netidee. Die gefundenen Schwachstellen wurden behoben.","breadcrumb":{"@id":"https:\/\/partizipationsbuero.at\/projekt-fortify-decidim\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/partizipationsbuero.at\/projekt-fortify-decidim\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/partizipationsbuero.at\/projekt-fortify-decidim\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/partizipationsbuero.at\/"},{"@type":"ListItem","position":2,"name":"Fortify.Decidim \u2013 Sicherheitsaudit f\u00fcr Decidim"}]},{"@type":"WebSite","@id":"https:\/\/partizipationsbuero.at\/#website","url":"https:\/\/partizipationsbuero.at\/","name":"mitgestalten - Partizipationsb\u00fcro","description":"L\u00f6sungen f\u00fcr B\u00fcrger:innenbeteiligung","publisher":{"@id":"https:\/\/partizipationsbuero.at\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/partizipationsbuero.at\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/partizipationsbuero.at\/#organization","name":"mitgestalten Partizipationsb\u00fcro","url":"https:\/\/partizipationsbuero.at\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/partizipationsbuero.at\/#\/schema\/logo\/image\/","url":"https:\/\/partizipationsbuero.at\/wp-content\/uploads\/2021\/08\/cropped-cropped-cropped-Bildschirmfoto-2021-08-31-um-08.26.25.png","contentUrl":"https:\/\/partizipationsbuero.at\/wp-content\/uploads\/2021\/08\/cropped-cropped-cropped-Bildschirmfoto-2021-08-31-um-08.26.25.png","width":1016,"height":254,"caption":"mitgestalten Partizipationsb\u00fcro"},"image":{"@id":"https:\/\/partizipationsbuero.at\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/80329013\/","https:\/\/github.com\/DecidimAustria"],"legalName":"Grithouse GmbH","description":"Das mitgestalten Partizipationsb\u00fcro richtet digitale Beteiligungsplattformen auf Basis der Open-Source-Software Decidim ein, hostet sie auf Servern in Deutschland und betreut sie \u2013 f\u00fcr St\u00e4dte, Gemeinden, Ministerien und Organisationen im gesamten deutschsprachigen Raum (\u00d6sterreich, Deutschland, Schweiz, Liechtenstein, S\u00fcdtirol) und international.","address":{"@type":"PostalAddress","streetAddress":"c\/o Impact Hub Vienna, Lindengasse 56\/18-19","postalCode":"1070","addressLocality":"Wien","addressCountry":"AT"},"telephone":"+43 650 5234835","vatID":"ATU77362015","areaServed":[{"@type":"Country","name":"\u00d6sterreich"},{"@type":"Country","name":"Deutschland"},{"@type":"Country","name":"Schweiz"},{"@type":"Country","name":"Liechtenstein"},{"@type":"Place","name":"S\u00fcdtirol"},{"@type":"Place","name":"Europ\u00e4ische Union"},{"@type":"Place","name":"International"}],"knowsAbout":["Decidim","Digitale B\u00fcrgerbeteiligung","E-Partizipation","B\u00fcrgerhaushalt \/ Partizipatives Budget","Open-Source-Software f\u00fcr Verwaltungen"]}]}},"_links":{"self":[{"href":"https:\/\/partizipationsbuero.at\/en\/wp-json\/wp\/v2\/pages\/3699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/partizipationsbuero.at\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/partizipationsbuero.at\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/partizipationsbuero.at\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/partizipationsbuero.at\/en\/wp-json\/wp\/v2\/comments?post=3699"}],"version-history":[{"count":2,"href":"https:\/\/partizipationsbuero.at\/en\/wp-json\/wp\/v2\/pages\/3699\/revisions"}],"predecessor-version":[{"id":3719,"href":"https:\/\/partizipationsbuero.at\/en\/wp-json\/wp\/v2\/pages\/3699\/revisions\/3719"}],"wp:attachment":[{"href":"https:\/\/partizipationsbuero.at\/en\/wp-json\/wp\/v2\/media?parent=3699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}