Going through mullvad's audit report,

> We asked Cure53 to focus solely on one OpenVPN and one WireGuard server. The scope included paying attention to anything that would impact privacy alongside their regular white-box security testing. Cure53 were given access to both servers, as well as the Ansible code used to deploy them.

> For this audit we deployed two VPN servers in our staging environment. Our staging environment is configured identically to production, bar that no customers connect to it, and the servers are virtual on hardware we own.

How is it an audit if you're not auditing production? Maybe some use cases can get away with it, but when the objective is privacy and security, environment differences can have helluva lot of implications.

They also don't seem to have been audited for no-logs. But they are very popular here for being a privacy focused service. What gives?

[flagged]