diff --git a/daprdocs/content/en/concepts/security-concept.md b/daprdocs/content/en/concepts/security-concept.md index 20892e71d..d7ceef443 100644 --- a/daprdocs/content/en/concepts/security-concept.md +++ b/daprdocs/content/en/concepts/security-concept.md @@ -211,6 +211,21 @@ The Dapr threat model is below. ## Security audit +### September 2023 + +In September 2023, Dapr completed a security audit done by Ada Logics. + +The audit was a holistic security audit with the following goals: + +- Formalize a threat model of Dapr +- Perform manual code review +- Evaluate Daprs fuzzing suite against the formalized threat model +- Carry out a SLSA review of Dapr. + +You can find the full report [here](/docs/Dapr-september-2023-security-audit-report.pdf). + +The audit found 7 issues none of which were of high or critical severity. One CVE was assigned from an issue in a 3rd-party dependency to Dapr Components Contrib + ### June 2023 In June 2023, Dapr completed a fuzzing audit done by Ada Logics. diff --git a/daprdocs/static/docs/Dapr-september-2023-security-audit-report.pdf b/daprdocs/static/docs/Dapr-september-2023-security-audit-report.pdf new file mode 100644 index 000000000..ebe454f62 Binary files /dev/null and b/daprdocs/static/docs/Dapr-september-2023-security-audit-report.pdf differ