Security verification

Assessment overview

Assessment date

2026-10-30

Last passing check

2026-10-30

Assessed source

API 0.9.6 · Web 0.9.6 · Android 0.9.17 (65)
b1375b306e7ba2b823dfeabe8398950b510d749b + WORKTREE
SHA-256 2ccce4a9696a8037683bb883a021d2470557b84a5dd58f9e43696a98d418c69f

Scope

Web, API, sessions, messaging, cryptography and selected Android source checks.

Coverage limitations

Production checks are non-destructive. Device validation, cloud configuration and formal protocol verification remain incomplete.

Verification methodology

Local tools and synthetic fixtures. Counts come from recorded results; unexecuted checks never pass.

Fixes require a reproducible regression case and a passing retest before being marked resolved. Incomplete checks remain visible.

Security architecture

LVR1 and LGS1 use authenticated encryption. Selected implementation tests cover hybrid key establishment and tamper rejection; they do not prove protocol security. The server still sees routing metadata.

Selected tests exercise token binding, CSRF protection, session revocation and cross-user access controls. Web-code delivery and endpoint security remain trust boundaries.

Outstanding findings

Confirmed issues and unresolved validation gaps are tracked separately. Zero confirmed findings does not mean zero vulnerabilities.

Dependency advisories and incomplete testing remain open. See the coverage limitations.

Critical 0 · High 0 · Medium 0 · Low 0

Responsible disclosure

Use the security-reporting address below with SECURITY in the subject. Avoid public disclosure of credentials or private messages.