Records in the public directory
As checked on 31 October 2026, the official directory lists NCC Group's 2016 review and its 2020 assessment with a 2022 remediation retest. Subgraph 2025 is still marked in progress. This guide does not treat that project as a completed review.
Read the scope before the conclusion
Start with the tested version, platform, dates and methods. A component assessment does not automatically cover every client or a release published years later. Distinguish findings, recommendations and verified fixes instead of relying on the word audited alone.
Relate the evidence to your needs
For account information or diagnostics, also read the privacy guide. For installer provenance, check the download channel and system prompts. Technical reviews, data policies and behavior on your device provide complementary evidence.
A report records checks within a particular scope and period. It is not a perpetual promise of no vulnerabilities, uninterrupted service or complete anonymity. This guide adds no unpublished test results.
Keep references you can check
When referring to a review, record the organization, year, tested version and retest date. The directory's PDFs are hosted by NCC Group and the Open Technology Fund. Check the original report and current release information before making an important decision; a promotional summary is not the full report.
Sources and scope
Sources checked on 31 October 2026. This is an editorial guide; check the current client for available features.
Lantern · Security Audits
https://lantern.io/zh/security-audits