IVPN infrastructure security audit concluded

We’re pleased to announce that an independent security audit of the new IVPN gateway infrastructure has concluded.

We recently decided it was necessary to upgrade our VPN gateway servers to a major new OS version which included many configuration changes. This provided a good opportunity to audit the new servers in our testing environment before deploying them to production for customer use.

Audit results

Two senior members of the Cure53 team conducted the audit over 6 days in February 2023. The audit was divided into two work packages:

1. Penetration tests and configuration review of the VPN gateway server.
2. Source code-assisted penetration tests against the VPN server OS and OS setup.

A white-box approach was used whereby the auditors had access to our public and private Github code repositories and a dedicated test environment. No access to production VPN servers or infrastructure was granted to members of the Cure53 team.

A total of 3 security vulnerabilities and 5 miscellaneous issues were discovered (1 medium, 6 low, 1 info). All issues have been remediated. As a result we are now planning the upgrade of our infrastructure with the new configuration. We have made the Cure53 report available for those interested in the details. For transparency we decided to publish the full report with only potentially sensitive information removed (internal hostnames etc).

Commitments going forward

We believe that extensive regular audits are necessary to ensure our customer’s security and continued trust. We continue to commit to an annual security audit where we will focus on those parts of our infrastructure and apps that we believe to be the most critical.

IVPN Team

Featured posts

Related posts

IVPN News

A security incident on our Bitcoin payment server

Posted on August 11, 2026 by IVPN Staff

Summary: on 7 August a critical vulnerability was disclosed in BTCPay Server, the open-source software we self-host to accept Bitcoin payments. It was being exploited before disclosure, and we were among the merchants hit: an attacker extracted our Lightning node credentials and transferred out our operating funds.

IVPN News

Annual security audit scheduled for 2026

Posted on June 19, 2026 by Nick Pestell

Consistent with our commitment to regular independent security audits, we have scheduled our eighth annual security audit with Cure53, to be conducted over the course of two weeks in July. As in previous years, audits target systems and services that have undergone significant updates and where review provides the most value to customers in terms of security and auditability.