Cure53
Overview
Cure53’s services include security analysis and architectural advice, black-box and white-box penetration tests and code audits, and infrastructure, platform and cryptography audits. Its website says it has performed several hundred penetration tests since it was founded in 2007, covering web applications, online services, hardware interfaces, mobile apps, libraries and crypto tools; reports are published only at the explicit request of project maintainers or the party that sponsored the test. Its team brings together independent security experts collaborating on a project basis.[1]
Contents8 sections
Key facts
2007Founded by Mario Heiderich
Cure53 was founded by the security expert Mario Heiderich and began as a one-person project before growing into a boutique firm.[2]
2016Starting VPN Audits
Cure53 began working with VPN providers in 2016, when TunnelBear asked it for a large system-wide audit; the providers it later audited include Surfshark and ExpressVPN.[2]
May 2021Auditing Surfshark’s Servers
Cure53 was given access to five Surfshark VPN servers in March 2021. Its report listed four general weaknesses, all rated Medium severity or lower, and said the results “should be interpreted as a good sign for the security and privacy properties of the Surfshark server and VPN configuration.”[3]
April 2022On VPN Audits
In an interview, Heiderich explained that audits can cover mobile and desktop apps, browser extensions, servers and infrastructure, web applications, cryptographic designs, payment processes, third-party integrations and build chains, and that the more areas examined and the more access granted, the more reliable the results. “We have seen some nasty things during our audits,” he said. He also noted that auditors cannot work with a threat model in which the provider itself is a possible adversary.[2]
Topic: Published Reports
As of November 2026, the reports published on Cure53’s website included a December 2024 audit of Coinbase’s cb-mpc library and cryptography, January 2025 tests of the MetaMaskMetaMaskMetaMask is a self-custodial crypto wallet and consumer finance platform originating in 2016, co-founded by Dan Finlay and Kumavis. It expanded from a browser wallet connecting users to Ethereum applications into multichain asset management and stablecoin payments. On September 9, 2026, Consensys Software Inc. announced its rebranding as MetaMask and independent operation under Chairman and CEO Joseph Lubin.Open the full entry Hedera Wallet Snap and Raspberry Pi web applications, and 2026 penetration tests of several ExpressVPN services; its academic papers include research on the cross-site scripting protection library DOMPurify.[1]
Related Organizations, Websites, and Public Accounts
Cure53: Website: https://cure53.de/ (opens in a new window)[1]