Mullvad VPN app

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Virtually all our development go directly into the publicly visible repository. All code review and comments happens in the open over at https://github.com/mullvad/mullvadvpn-app/pulls. Build of the main branch are continuously uploaded to the following URL, but not intended for end user consumption: https://releases.mullvad.net/

Repository on GitHub, which uses git. git is distributed.

A signed git tag is pushed to github pointing to the commit that produced the binaries for that release.

Non-trivial release notes file in repository: https://github.com/mullvad/mullvadvpn-app/blob/main/CHANGELOG.md.

https://mullvad.net/en/help/how-report-bug-or-vulnerability

https://github.com/mullvad/mullvadvpn-app/issues

For in-app problem reports, a dedicated support team respond with a day or two at most. For issues reported on Github, we have a rotating responsibility with the development team, where one person is responsible for monitoring the issue tracker and respond.

Similar to how we handle bug reports. The same mechanisms are used to respond to enhancement requests: Support team + rotating responsibility within the app development team.

https://github.com/mullvad/mullvadvpn-app/issues

https://github.com/mullvad/mullvadvpn-app/security/advisories/new

The vulnerability reported on Github are kept secret (only sent to the team): https://github.com/mullvad/mullvadvpn-app/security/advisories/new. We also accept OpenPGP encrypted emails to our support team, where users can report sensitive issues. https://mullvad.net/en/help/how-report-bug-or-vulnerability

Security and privacy related issues are a top priority for Mullvad. We always act fast if we get reports about things that might be security issues. How we respond depends on how the issue was reported. But our support team reply to all inquires within just a few days. Security issues reported to Github become a top priority for the development team.

Instructions on how to build are available in the repository: https://github.com/mullvad/mullvadvpn-app/blob/main/BuildInstructions.md

This is as true as it can be. To build for iOS, Xcode is needed, but that's unavoidable.

There are many tests for the different platforms. And they are invoked in different ways. The Github action workflows define how they are executed: https://github.com/mullvad/mullvadvpn-app/tree/main/.github/workflows. On top of this we have an extensive integration test suite that lives in the same repository: https://github.com/mullvad/mullvadvpn-app/tree/main/test

The full integration test suite (https://github.com/mullvad/mullvadvpn-app/tree/main/test) is executed every day and the results directly visible to the development team. And every PR runs the relevant compilation and unit tests via Github Actions.

We have internal rules and guidelines telling the team that all new features must have automatic tests added to the code before that feature is regarded as complete.

Since we add tests for most changes, especially new features, we feel that it's superfluous to add to every changelog item that tests were also merged. That's simply assumed and SHOULD be the case all the time.

The test-requirement is listed in our Github pull request template checklist.

Our CI run compilers and linters for all the languages we use. They are all set to pretty strict settings.

We do not allow warnings from the compilers/linters. All warnings are upgraded to errors and forbidden.

Secure development best practices are part of the culture in the team. But there is also a designated tech lead who is also one of the core developers as well as responsible for the security around both development and releasing the software.

Clippy, Detekt, AGP lint, Konsist, swiftlint, ESLint, Shellcheck, socket.dev, mobsfscan

All issues found by the analyzers we run, are treated as CI errors and must be fixed up front.