> For the complete documentation index, see [llms.txt](https://learn.cypherock.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.cypherock.com/security-overview/securing-data-x0-card-security-audit.md).

# Securing Data X0 Card Security Audit

> “The product is well implemented with state of the art countermeasures and good defense in depth.” - Securing Data

The software that runs inside the X0 Cards has been independently audited by Securing Data, a hardware security firm led by Jean Dubreuil. The audit was completed in October 2026.

The audit reviewed the source code and documentation of the X0 Card software against a demanding attacker profile. The attacker was assumed to be able to send any command with any content to the card, and to observe and manipulate the card while it operates using advanced, specialized equipment, including power analysis, card tearing and laser fault injection. The audit examined every command available on the X0 Card and how each of them protects the card's provisioning keys, the user's wallet PIN and seed, and the secrets used in the encrypted sessions between the card and the app, and between cards.

The audit found no vulnerabilities concerning software attacks or side-channel attacks. It identified 4 vulnerabilities related to fault injection attacks, which require specialized equipment and physical access to the card. All of these findings have been fixed in the X0 Card software that ships to users.

{% hint style="info" %}
The wallet PIN is not only verified by the card, but is also required to decrypt the shards stored on it. Even an attacker who managed to disturb the PIN verification would still need to know the PIN to use the wallet.
{% endhint %}

The audit report is available [here](broken://pages/97bc4831d90c87b9980eb183d48cebe9c2813f4c).