so, tired of the vpn section. everyone's posting 'we passed an audit' like it's a get out of jail free card. lmao. need to see who actually got a proper independent audit and who paid for a press release. mullvad gets it, they publish the full report. proton too. most of the big names just get a 'security assessment' that says their app icon looks nice. i just pulled reports for a client. three major vpns claiming audits, one was literally a two-page pdf from a firm that also does their marketing. that's not an audit, that's a receipt. if you're looking at this for real privacy, ask for the scope. did they check server configurations? verify no-log claims under pressure? most audits are a surface level app check, which is fine for speed but useless if you're trying to not get a letter from your isp. i'm rushing to a call but my rule is, if they don't link to the full public report from a known firm like cure53, assume it's theater. the data is never on their side.