Gallery Security and Gotham Digital Science

Vulnerabilities in web applications (like Gallery) are increasingly a sweet spot for attackers. We are very aware of this, and take the security of the Gallery project very seriously. In addition to our internal guidelines, processes and audits, we’ve had external security experts perform security audits of our code for the last several releases of Gallery 2.

Recently, we retained Gotham Digital Science (GDS) to perform security audits on Gallery 1 and 2. They are experts in application security, as it's basically all they do. The relationship we have built with GDS has proven valuable based on the results of the audits and we are looking forward to partnering with them on audits of future versions of Gallery. Please read on!

We recognize that hiring external consultants to perform security audits does not guarantee that our code is bug-free and by no means un-hackable, but it clearly indicates our willingness to perform due diligence to make sure our code is reasonably secure. The combination of an external perspective of security experts and the insight of internal experts both performing detailed audits is yielding much better results than only one of the two perspectives alone.

External security audits perfectly complement and improve our internal measures to produce secure software. The audits not only help identifying specific security issues, but it’s an independent review of our internal measures as well, exposing general strengths and weaknesses in the development process. We learn what works well, what needs to be improved and can adjust our internal measures accordingly.

Like any other software, Gallery has bugs and some of those bugs may affect security. While we cannot guarantee that future versions of Gallery or completely bug-free, external audits and our constantly improving internal measures contribute a great deal to make the next Gallery release always the most secure one ever.

Gotham Digital Science did a great job on their audits of portions of the Gallery 1 and 2 code bases and the dialog between their experts and our developers proved to be very fruitful for security enhancements in Gallery 1 and 2. We plan to continue working with them to help secure future versions of Gallery. Check out their blog, and remember, your donations help pay for things like this!