All SukuPay operations have been audited by Highland Security. During the course of our testing of the Suku Labs pay web application, the testing team found that the source code version reviewed adhered to current Open Web Application Security Project (OWASP) and cloud security best practices.
After addressing the findings and observations captured in this report and if no other major subsequent changes are made to the code, we believe the security posture of the SukuPay product is satisfactory in mitigating the likely risks from threat actors.
In addition, through our review we found the SukuPay wallet architecture is sufficiently segmented such that no customer wallet private key or recovery material would be accessible by Suku Labs personnel. All key sharding and wallet recovery operations are handled by a third party, Privy.io, and are outside the scope of control for Suku Labs.
The Suku Labs team was able to provide documentation for the expected operation of the product and was receptive to feedback provided by the team. There were no Critical rated findings identified during the testing.
Última actualización hace 4 meses