FPF has contracted @mmaker for a preliminary audit of a frozen version of the protocol (November 2023) at commit 2f32d0b

The report has been delivered at the beginning of January 2024.

The resulting report is attached to this issue.
securedrop report.pdf

We should keep track of the findings and address them and the improvement recommendations.