Every claim, labelled: why our security page lists what we don't promise

Description and use

A single-page security claims system for Vardum that transparently lists what is promised and what is not, with clear limits and labels.

Problem

Ensuring transparent and honest security claims for a private messenger.

Outcome

A transparent, single-page security claims system that clearly states what is promised and what is not, improving developer and user trust.

Workflow

• Create a dedicated security claims page.
• Assign each claim an ID and one of four labels: Implemented, New, Verified, not claimed.
• Document limits next to each claim.
• Publish the page at tryvardum.app/claims/.
• Update claims when code changes or audits are completed.

Evidence

I build Vardum, a private messenger, mostly on my own. Early on I made one rule for the website: every security claim goes on a single page, with its limits next to it, and if any other page disagrees with that one, that page wins.

Source

Each entry has an ID and one of four labels: Implemented, New, Verified, not claimed.

Source

The code is public under AGPL-3.0: github.com/VardumTechnology/Vardum.

Source

If you find a claim the code doesn't back up, tell me at [email protected] and the page changes.

Source