To better protect our users, we addressed the security vulnerabilities as soon as they were discovered and reported to us, without waiting for the audit to be complete and public.
> The Tailsoperating system leaves a strong security impression, addressing > most anonymity-related concerns. We did not find any remote code execution > vulnerabilities, and all identified issues required a compromised > low-privileged `amnesia` user – the default user in Tails. > > Looking back at the [[previous audit|audit_by_ROS]], we can see the Tails > developers have made significant progress, demonstrating expertise and a > serious commitment to security.
Our team went further than simply fixing these issues. We conducted a *postmortem* to understand *how* we introduced these vulnerabilities in our releases and *what* we could do to avoid similar vulnerabilities in the future.This analysis led to technical, policy, and culture changes.
This analysis was useful and we'll definitely consider doing postmortems again after future audits. It might also be useful for other projects to understand how we worked on these long-lasting improvements.
While preparing a major Tails release based on a new version of Debian, for example, Tails 7.0, we will look for Perl code included in Tails that modifies `@INC` in a dangerous way. ([[!tails_ticket 19627]])
To have better guidelines for confidentiality and disclosure, we created our [[security issue response policy|contribute/security_policy]], based on the policy of the Tor Project's Network Team.
