Summary
app.json:8 registers the protestchat:// scheme, and expo-router auto-linking means any website, QR code, or other app can push protestchat://verify/<publicId> or protestchat://chat/<id> onto the navigation stack with no confirmation. The verify screen then presents a live "They match — mark verified" button (src/app/verify/[id].tsx:88-93).
Why it matters
A link alone can't forge a matching safety number, but it delivers a pre-armed verification UI outside the in-person ritual — a social-engineering assist against the one MITM defence (A5), aimed at exactly the stressed, non-expert users the threat model describes. ("Your organizer sent you this link to verify them — tap here, the numbers match.")
Proposed fix
If the scheme exists only for development, drop it for release builds. Otherwise gate external intents: ignore deep links into verify/ (or require the contact-introduction flow to have been started in-app) and never deep-link directly into a verification confirmation.
Found during an external security review of the codebase.
Summary
app.json:8registers theprotestchat://scheme, and expo-router auto-linking means any website, QR code, or other app can pushprotestchat://verify/<publicId>orprotestchat://chat/<id>onto the navigation stack with no confirmation. The verify screen then presents a live "They match — mark verified" button (src/app/verify/[id].tsx:88-93).Why it matters
A link alone can't forge a matching safety number, but it delivers a pre-armed verification UI outside the in-person ritual — a social-engineering assist against the one MITM defence (A5), aimed at exactly the stressed, non-expert users the threat model describes. ("Your organizer sent you this link to verify them — tap here, the numbers match.")
Proposed fix
If the scheme exists only for development, drop it for release builds. Otherwise gate external intents: ignore deep links into
verify/(or require the contact-introduction flow to have been started in-app) and never deep-link directly into a verification confirmation.Found during an external security review of the codebase.