Audit

Turbine backend and frontend (including SDK) have been audited by Trail of Bits.

Backend audit

Trail of Bits audited the backend at commit 9644d88d5aee50a4f93feaeb646123b74730b015 (2025-11-17).

Audit report: Propeller Heads Turbine Security Review

Frontend and SDK audit

Trail of Bits audited the frontend at commit fba934df4eca0c11f4b84cfaa1860e4142e3a680 (2026-01-05), and SDK at commit d5ed0b7615afdf2dcac3faae2eacd02342878960 (2026-01-05; equivalent to version 0.13.2 with some documentation commits cherry-picked on top).

Audit report: Propeller Heads Turbine Frontend & SDK Security Review

Changes after audit

PropellerHeads applied fixes after receiving the audit report. Trail of Bits then audited the fixes; the findings are in the reports linked above.

PropellerHeads kept developing Turbine while Trail of Bits reviewed the code. Trail of Bits has not audited some newer parts. PropellerHeads consults an internal security consultant on all significant changes. A formal audit of post-review changes will follow.