Every claim, labelled: why our security page lists what we don't promise

Описание и применение

Веб‑страница с прозрачными заявками о безопасности Vardum, где каждая заявка имеет ограничение и метку, позволяющая пользователям и разработчикам понять, что гарантируется, а что нет.

Задача

Ensuring transparent and honest security claims for a private messenger.

Результат

A transparent, single-page security claims system that clearly states what is promised and what is not, improving developer and user trust.

Рабочий процесс

• Create a dedicated security claims page.
• Assign each claim an ID and one of four labels: Implemented, New, Verified, not claimed.
• Document limits next to each claim.
• Publish the page at tryvardum.app/claims/.
• Update claims when code changes or audits are completed.

Доказательства

I build Vardum, a private messenger, mostly on my own. Early on I made one rule for the website: every security claim goes on a single page, with its limits next to it, and if any other page disagrees with that one, that page wins.

Источник

Each entry has an ID and one of four labels: Implemented, New, Verified, not claimed.

Источник

The code is public under AGPL-3.0: github.com/VardumTechnology/Vardum.

Источник

If you find a claim the code doesn't back up, tell me at [email protected] and the page changes.

Источник