Cybersecurity risk assessment

Product: Seeker Scout version 0.11.0 Manufacturer: Bilal El Homsi Generated: 2026-10-24 by cra-dossier 0.1.0 from the repository seeker-scout at commit 19267dd96bc8 Regulation: Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024, http://data.europa.eu/eli/reg/2024/2847/oj

DRAFT generated from the repository for the manufacturer to review, complete and sign. This is not legal advice. This document makes no claim that the product conforms to Regulation (EU) 2024/2847 and no claim about CE marking; conformity is declared only by the manufacturer, on its sole responsibility, after completing the human items in the gap list.

Article 13(2): the manufacturer undertakes an assessment of the cybersecurity risks associated with the product and takes the outcome into account during planning, design, development, production, delivery and maintenance. Article 13(3): documented and updated during the support period; it comprises at least an analysis of risks based on the intended purpose, reasonably foreseeable use and conditions of use (operational environment, assets to be protected, expected time in use), says whether and how each Annex I, Part I, point (2) requirement applies and is implemented, and how Part I, point (1) and Part II are applied. Article 13(4): where a requirement is not applicable, the technical documentation includes a clear justification. Guidance C(2026) 5252, section 7, describes the evaluation and treatment of risks and due diligence on external dependencies.

1. Context

• Intended purpose: Seeker Scout is a companion app for the Solana Seeker phone's dApp Store. It shows a trend-ranked catalog of the apps in the store with freshness and update signals, lets Seeker owners vouch for apps and reply to vouches after verifying ownership of the Seeker Genesis Token in their wallet, shows Staked SKR weight, and offers a paid Alpha digest tier. It is distributed through the Solana dApp Store to consumers.
• Operational environment: Runs on a Solana Seeker (Android) obtained from the Solana dApp Store, which verifies the package signature on install and update. Wallet keys stay in the phone's Seed Vault; the app receives an address and message signatures only. All network calls are HTTPS to the manufacturer's catalog and lounge services on Cloudflare, to Solana Mobile dApp Store assets and to a public Solana RPC endpoint. The user is responsible for the device lock and for approving signatures in the wallet.
• Expected time in use: 5 years (support period decision in 06_support_period.md)
• Platforms and interfaces (from the scan): Expo / React Native, Android; 7 external hosts; 0 Android permissions.

2. Assets to protect

• Integrity of the catalog and vouch data shown to users: users act on rankings and vouches when choosing apps
• Wallet signatures and the Genesis Token check: a forged vouch would misrepresent a Seeker owner
• Integrity of the app build: a tampered build could phish wallet approvals
• Availability of the catalog and the lounge worker: the app degrades to the bundled seed catalog without them

3. Threats considered

• A tampered build distributed outside the dApp Store
• Forged or replayed vouch signatures against the lounge worker
• A vulnerable third-party SDK (wallet adapter, web3, storage) in the dependency tree
• Catalog poisoning through the upstream catalog source read by the indexer
• Abuse of the open ping or vouch endpoints (volume, spam)
• Phishing through look-alike apps imitating the wallet sheet

4. Risks accepted

• The catalog is derived from a third-party index of the dApp Store; rankings can lag the store by up to a day

5. Annex I, Part I: applicability and implementation per requirement

Annex I, Part I, point (1): Appropriate level of cybersecurity based on the risks

Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks.

• Applicable: Yes

• Status from the scan: Partly shown. A risk assessment input exists (answers or a security policy text). The appropriate level of cybersecurity is a judgment the manufacturer documents in the risk assessment (Article 13(2) and (3)).

• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]

• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(a): No known exploitable vulnerabilities at release

be made available on the market without known exploitable vulnerabilities;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]

• Status from the scan: Not found. 51 known vulnerability advisories affect 23 components in the SBOM (OSV, 2026-10-23); 0 of them are in components the SBOM marks as required (likely shipped), the rest in optional or build-time components. Each needs triage: exploitable in this product or not, and if yes, fixed before release.

• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]

• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(b): Secure by default configuration, with reset to original state

be made available on the market with a secure by default configuration, unless otherwise agreed between manufacturer and business user in relation to a tailor-made product with digital elements, including the possibility to reset the product to its original state;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]
• Status from the scan: Partly shown. Debug-only code paths exist; confirm they are compiled out of the release build and that shipped defaults are the secure ones. Permissions declared: none found; blocked: android.permission.READ_EXTERNAL_STORAGE, android.permission.WRITE_EXTERNAL_STORAGE, android.permission.SYSTEM_ALERT_WINDOW, android.permission.RECORD_AUDIO.
• Evidence:
  • App.tsx:188 if (!DEV) pingOpen();
  • src/lib/chat.ts:19 DEV && typeof process.env.EXPO_PUBLIC_CHAT_URL === 'string' && process.env.EXPO_PUBLIC_CHAT_URL
• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]
• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(c): Security updates, automatic where applicable, with notification and opt-out

ensure that vulnerabilities can be addressed through security updates, including, where applicable, through automatic security updates that are installed within an appropriate timeframe enabled as a default setting, with a clear and easy-to-use opt-out mechanism, through the notification of available updates to users, and the option to temporarily postpone them;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]

• Status from the scan: Not found. No update distribution channel was found in the repository.

• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]

• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(d): Protection from unauthorised access; report possible unauthorised access

ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems, and report on possible unauthorised access;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]
• Status from the scan: Partly shown. Access-control mechanisms were found (bearer token sent to a service; OAuth / OpenID / social sign-in; Mobile Wallet Adapter / wallet signing (Solana)). Whether they cover every protected function and whether possible unauthorised access is reported is for the manufacturer to confirm.
• Evidence:
  • src/lib/alpha.ts:716 headers: { authorization: [redacted] },
  • src/lib/chat.ts:192 token ? { headers: { authorization: [redacted] } } : {},
  • src/lib/game.ts:120 ...(token ? { authorization: [redacted] } : {}),
• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]
• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(e): Confidentiality of stored, transmitted or processed data (encryption at rest and in transit)

protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]
• Status from the scan: Partly shown. 7 external hosts are reached over https:// and 0 over http://. Unencrypted on-device storage is also used; list what it holds and why that is acceptable.
• Evidence:
  • src/lib/alpha.ts:1 import AsyncStorage from '@[token]';
  • src/lib/catalog.ts:1 import AsyncStorage from '@[token]';
• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]
• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(f): Integrity of data, commands, programs and configuration; report corruptions

protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration against any manipulation or modification not authorised by the user, and report on corruptions;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]
• Status from the scan: Partly shown. The app platform verifies the package signature on install and update, which protects program integrity; integrity of stored data and configuration against unauthorised modification is for the manufacturer to describe.
• Evidence:
  • lounge-worker/src/alpha.js:113 crypto.subtle.digest('SHA-256', enc.encode(presented)),
  • lounge-worker/src/game.js:74 await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(label)),
• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]
• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(g): Data minimisation

process only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of the product with digital elements (data minimisation);

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]

• Status from the scan: Partly shown. 0 Android permissions declared; 2 device-capability packages; no analytics or crash-reporting SDK found.

• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]

• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(h): Availability of essential functions, including after an incident and against denial of service

protect the availability of essential and basic functions, also after an incident, including through resilience and mitigation measures against denial-of-service attacks;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]
• Status from the scan: Partly shown. Rate limiting or throttling code was found.
• Evidence:
  • lounge-worker/src/chat.js:261 // 403 whatever reply_to says) and before the rate-limit slot, so a
• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]
• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(i): Minimise negative impact on other devices or networks

minimise the negative impact by the products themselves or connected devices on the availability of services provided by other devices or networks;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]

• Status from the scan: Manufacturer decision. Whether the product can degrade other devices or networks (traffic volume, broadcast behaviour, background work) is a design statement.

• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]

• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(j): Limited attack surfaces, including external interfaces

be designed, developed and produced to limit attack surfaces, including external interfaces;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]

• Status from the scan: Partly shown. External interfaces found: 7 remote hosts, 0 permissions, 4 permissions explicitly blocked. Deep links and intents are an external interface on mobile apps; list every scheme and intent filter.

• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]

• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(k): Exploitation mitigation mechanisms

be designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]

• Status from the scan: Manufacturer decision. Mobile platforms provide sandboxing, memory-safe runtimes and signed packages; which of these the product relies on, and what it adds (least privilege, no dynamic code loading, pinned dependencies), is a statement.

• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]

• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(l): Security-related logging and monitoring with a user opt-out

provide security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user;

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]
• Status from the scan: Partly shown. Logging or telemetry code found (console logging); no user opt-out setting was found. Security-relevant events (access to or modification of data, services or functions) need recording with an opt-out mechanism for the user.
• Evidence:
  • scripts/gen-publisher-key.mjs:14 console.error(\n⛔ A key already exists at:\n ${out}\n Refusing to overwrite. (Delete it first if you truly want a new one.)\n);
  • scripts/print-key-for-wallet-import.mjs:19 console.log('\nPublic address :', kp.publicKey.toBase58());
  • indexer/detect-perks.mjs:146 console.log(perks: ${perks.length}/${apps.length} apps with reward signals);
• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]
• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

Annex I, Part I, point (2)(m): Secure and easy permanent removal of all data and settings

provide the possibility for users to securely and easily remove on a permanent basis all data and settings and, where such data can be transferred to other products or systems, ensure that this is done in a secure manner.

• Applicable: Yes [HUMAN: confirm, or mark not applicable with a justification]
• Status from the scan: Partly shown. A sign-out or disconnect flow exists but no explicit delete-all-data flow was found. Uninstalling removes app-private data on mobile platforms; server-side data and any cloud backups need their own path.
• Evidence:
  • src/screens/ProfileScreen.tsx:79 function onDisconnect() {
• How the requirement is implemented: [HUMAN: describe the measure, or the reason it is not needed for this product]
• Residual risk and acceptance: [HUMAN: low / medium / high, accepted by whom, on what date]

6. Vulnerability handling (Annex I, Part II) as applied

See 04_vulnerability_handling.md; Article 13(3) asks this assessment to say how Part II is applied: [HUMAN: one paragraph]

7. Review log