Crisis Connect

Crisis Connect is an offline-first emergency communication application published for Android and iOS. Its public repository contains both mobile implementations, Firebase Functions and Firestore security rules under the project's declared AGPL-3.0 license. Google Play shows 10K+ downloads (10 October 2026); this does not establish active usage or independently verified emergency deployments.

This request supports a bounded independent review of agreed high-risk identity/pairing, authentication, replay, malformed-input, local-storage and Firebase authorization paths at a fixed code revision, with reporting, one retest and repeatable physical-iOS-device testing.

The USD 18,000 service estimate allocates 12 reviewer-days at USD 1,500/day: scope/setup 1 day (USD 1,500); Android 3 days (USD 4,500); iOS/cross-platform 3 days (USD 4,500); Firebase trust boundaries 2 days (USD 3,000); findings/coverage report 1 day (USD 1,500); bounded fix verification 2 days (USD 3,000). No auditor is selected. This is a planning estimate, not a supplier quote; reviewer-days are effort, not a completion deadline. Final scope and applicable service taxes/fees must fit the award or be revised with the funder before commitment.

Outputs would record coverage/exclusions, reproducible findings and verification results. This is not exhaustive security certification. The retest is inside the service allocation, not an additional charge atop a package already including it.

Related review and device funding applications remain pending. Each overlapping expense and deliverable would be funded only once. The USD 420 device allocation would be removed or revised with the funder before spending if funded elsewhere. Company formation, maintainer remuneration and non-public products are outside this budget.