{
  "schemaVersion": "1.0",
  "status": "completed-static-and-public-evidence-assessment",
  "provider": "Proton VPN",
  "testDate": "2026-07-29",
  "reviewTeam": "Openscore VPN",
  "verificationPlatform": "VPNTestor",
  "artifacts": [
    {
      "platform": "Android",
      "version": "5.19.61.0",
      "packageId": "ch.protonvpn.android",
      "sourceUrl": "https://github.com/ProtonVPN/android-app/releases/download/5.19.61.0/ProtonVPN-5.19.61.0.605196100.-production-vanilla-direct-release.apk",
      "sizeBytes": 55806557,
      "sha256": "568b0f05ae0411b932de2ac8bff96c5c2268e617b75f9194d0122a838517633a",
      "githubPublishedDigest": "sha256:568b0f05ae0411b932de2ac8bff96c5c2268e617b75f9194d0122a838517633a",
      "minimumSdk": 26,
      "targetSdk": 35,
      "signature": { "apkSignatureSchemeV2": "verified", "apkSignatureSchemeV3": "verified" },
      "hardening": { "debuggable": false, "allowBackup": false, "customNetworkSecurityConfig": true },
      "notablePermissions": [
        "android.permission.QUERY_ALL_PACKAGES",
        "android.permission.CAMERA",
        "android.permission.RECEIVE_BOOT_COMPLETED",
        "android.permission.USE_BIOMETRIC"
      ]
    },
    {
      "platform": "Windows",
      "architecture": "x64",
      "version": "5.1.5",
      "sourceUrl": "https://github.com/ProtonVPN/win-app/releases/download/v5.1.5/ProtonVPN_v5.1.5_x64.exe",
      "sizeBytes": 128808528,
      "sha256": "1e6600e45c0684d0faa7f040208603b72a0f7b1468b682c1007a31972cba1d9c",
      "githubPublishedDigest": "sha256:1e6600e45c0684d0faa7f040208603b72a0f7b1468b682c1007a31972cba1d9c",
      "signature": {
        "authenticodePresent": true,
        "securityDirectorySize": 12296,
        "certificateType": "EV code signing",
        "subject": "Proton AG",
        "organizationIdentifier": "CHE-354.686.492",
        "issuer": "Sectigo Public Code Signing CA EV R36",
        "timestampChainPresent": true
      }
    }
  ],
  "publicEvidence": {
    "openSourceOrganization": "https://github.com/ProtonVPN",
    "noLogsAudit2026": "https://drive.proton.me/urls/DZVEJZFYHM#FPSKdUEykprb",
    "auditSummary": "https://protonvpn.com/blog/no-logs-audit",
    "transparencyReport": "https://protonvpn.com/blog/transparency-report"
  },
  "findings": [
    {
      "id": "PROTON-2026-001",
      "severity": "low",
      "title": "Broad Android permissions require a maintained public rationale",
      "evidence": "The production manifest requests QUERY_ALL_PACKAGES and CAMERA alongside VPN lifecycle permissions.",
      "recommendation": "Maintain a versioned permission and data-flow matrix and use the narrowest package visibility technically possible."
    },
    {
      "id": "PROTON-2026-002",
      "severity": "informational",
      "title": "Release digests rely on the same GitHub release channel",
      "evidence": "Downloaded hashes matched GitHub's published asset digests exactly.",
      "recommendation": "Publish signed release manifests through a second first-party channel or transparency log."
    }
  ],
  "score": {
    "finalOverallVpnScore": null,
    "staticAndPublicEvidenceScore": 92,
    "scale": 100,
    "breakdown": [
      { "category": "Artifact integrity and provenance", "earned": 29, "available": 30 },
      { "category": "Platform signing", "earned": 28, "available": 30 },
      { "category": "Permissions and production hardening", "earned": 17, "available": 20 },
      { "category": "Public security transparency", "earned": 18, "available": 20 }
    ]
  },
  "notTested": [
    "IPv4, IPv6, DNS, WebRTC and route leakage",
    "Kill Switch behavior during interruption, termination, sleep/wake and network switching",
    "Account, token, dashboard and cross-account authorization",
    "Local runtime logs, credential storage and uninstall remnants",
    "Independent macOS and iOS binary inspection",
    "Streaming availability, sustained throughput and latency",
    "Server-side penetration testing beyond the published Securitum scope"
  ],
  "limitations": [
    "92/100 applies only to the completed static client, supply-chain and public security evidence scope.",
    "It is not Proton VPN's overall product score and does not replace runtime or infrastructure penetration testing.",
    "The result applies only to the exact Android and Windows hashes recorded above."
  ]
}