Good catch. Mario actually provided a marketable quote via email (signed and all). Although that quote is intended as a one-sentence summary of Mario&#x27;s report, it&#x27;s not strictly a quote out of the report as much as it <i>is</i> strictly a quote from Mario. Therefore, the source on the quote might more accurately be attributed as &quot;Mario Heiderich in summarizing the Cure53 pentest report.&quot;<p>The thinking there was that there wasn&#x27;t a good way to quote any single part of the report without introducing unnecessary and&#x2F;or fishy ellipses, because although the point of the rest of the conclusion is that it confirms the claim made by Cyph, there wasn&#x27;t a readily available standalone sentence in there which could go on the front page.<p>Background: I advised Cyph on AppSec topics on behalf of Mach37 as a mentor, and I helped coordinate the Cure53 pentest. I&#x27;m the one who sourced the quote.<p>Give me a few moments (or days; we&#x27;ll see) for me to find a good way to publicly and non-repudiably present the exact source of the quote.<p><i>Edit: </i><p>Signed statement: <a href="http:&#x2F;&#x2F;pastebin.com&#x2F;HcL5bneg" rel="nofollow">http:&#x2F;&#x2F;pastebin.com&#x2F;HcL5bneg</a><p>Key: <a href="https:&#x2F;&#x2F;keybase.io&#x2F;cure53" rel="nofollow">https:&#x2F;&#x2F;keybase.io&#x2F;cure53</a><p>Hat tip to Mario (<a href="https:&#x2F;&#x2F;twitter.com&#x2F;0x6d6172696f" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;0x6d6172696f</a>)