diff --git a/content/post/00011-security-audit-1/index.md b/content/post/00011-security-audit-1/index.md
new file mode 100644
index 0000000..7eaf612
--- /dev/null
+++ b/content/post/00011-security-audit-1/index.md
@@ -0,0 +1,19 @@
+---
+title: "ROS Security Audit"
+date: 2024-04-15
+resources:
+- src: "pentest_1.pdf"
+  title: "Monal IM penetration test report 2024 1.0"
+  params:
+    icon: pdf
+
+tags: []
+author: "Thilo Molitor"
+---
+
+<a href="https://www.radicallyopensecurity.com/">Radically Open Security (ROS)</a> kindly performed a security audit of some parts of Monal.  
+Specifically they audited the usage of our XML query language and the implementations of <a href="https://xmpp.org/extensions/xep-0388.html">SASL2</a>, <a href="https://datatracker.ietf.org/doc/html/rfc5802">SCRAM</a> and <a href="https://xmpp.org/extensions/xep-0474.html">SSDP</a>.
+
+The results in a nutshell: *no security issues found*, read the full report here: {{< pdfLink "pentest_1.pdf" title="Pentest Report" >}}.
+
+
diff --git a/content/post/00011-security-audit-1/pentest_1.pdf b/content/post/00011-security-audit-1/pentest_1.pdf
new file mode 100644
index 0000000..b41caec
Binary files /dev/null and b/content/post/00011-security-audit-1/pentest_1.pdf differ
diff --git a/layouts/shortcodes/pdfLink.html b/layouts/shortcodes/pdfLink.html
new file mode 100644
index 0000000..1af2318
--- /dev/null
+++ b/layouts/shortcodes/pdfLink.html
@@ -0,0 +1,9 @@
+{{ if .IsNamedParams }}
+  {{ $pdf := $.Page.Resources.GetMatch (.Get "name") }}
+  {{ $title := cond (not (.Get "title")) $pdf.Title (.Get "title") }}
+{{ else }}
+  {{ $pdf := $.Page.Resources.GetMatch (.Get 0) }}
+  {{ $title := cond (not (.Get 0)) $pdf.Title (.Get 0) }}
+{{ end }}
+
+<a href="{{ $pdf.RelPermalink }}">{{ $title | safeHTML }}</a>.