QryptChat — Authorization and E2EE Architecture
Summary
Security and architecture assessment of QryptChat covering participant authorization, Supabase RLS boundaries, RPC behavior and the application E2EE model.
Document record
- Author
- Eduardo Camarillo [Noir0x63]
- Published
- Version
- v2.0
- Language
- English
1. Scope and Method
Two review passes over the QryptChat messaging platform, covering participant authorization, Supabase RLS and RPC behavior, web APIs, and the application encryption model. Remediation status is documented against the reviewed repository state.
2. Selected Findings
Conversation Membership & User-table Read Policy (CVSS 8.3)
NEW-01 and V-002 did not consistently enforce conversation membership and allowed reads beyond the intended user-table boundary.
Remediation verified in the reviewed version: RPC session validation and revised RLS policies.
Primary evidence: Project advisories. The advisory records the affected versions and technical mechanism; a fix or retest requires separate evidence.