Verifiable by anyone
Open-source encryption
Every byte your browser encrypts is produced by code you can read, hash and compare. The DRIVUNO encryption module is published in full, so that anyone — you, your security team, an independent auditor — can verify that keys never leave your device.
Why publishing the code makes it safer, not weaker
Since Kerckhoffs' principle (1883), sound cryptography has rested on one rule: secrecy must live in the keys, never in the design. The encryption code ships to every browser anyway — hiding it stops no determined analyst. Publishing it lets thousands of honest eyes verify it. Your security depends on keys only you hold, not on obscurity.
What is published
The complete client-side encryption module, under a source-available licence: reading, auditing and verifying are allowed; commercial reuse is not. Each file below is hashed live in your browser — the fingerprint proves you are reading the exact bytes we published.
- crypto.ts
Key derivation (Argon2id), authenticated encryption (XChaCha20-Poly1305), streaming encryption for large files, sealed boxes (X25519), recovery keys, proof-of-knowledge schemes.
- crypto-signatures.ts
Ed25519 signatures over canonical JSON, ciphertext hashing, constant-time comparison, secure buffer wiping, device-adaptive KDF profiles.
- metadata-privacy.ts
Padmé length padding and timing jitter — ciphertext sizes and request timing should reveal as little as the content does.
- integrity.ts
SHA-256 verification of ciphertext before decryption — corruption or tampering is detected, never silently decrypted.
- mail-seal-server.ts
Pure-JS reference used at the edge to encrypt incoming external mail straight to the recipient's public key — byte-compatible with the client, interoperability test included.
What we deliberately do not publish
The encryption code is public; the operational defences are not. Server configuration, defence tuning, monitoring thresholds and internal data layout stay private — publishing them would help an attacker plan without helping an auditor verify the cryptography. Accredited researchers can request deeper access through the bug-bounty programme.
Verify it yourself in two minutes
- Open your browser's developer tools (F12), Network tab.
- Upload a file or send a message on DRIVUNO.
- Inspect the request payloads: only opaque, random-looking bytes leave your device. Search the traffic for a word from your content — it is not there.
- Or open the live demo and watch the transformation byte by byte. Watch encryption happen live
Audited code = served code
Publishing source answers “what is the encryption?” — not “is that what my browser received?”. Every build emits a public manifest with the SHA-256 of every file we serve. The integrity page re-hashes what your browser actually loaded and compares it with that manifest on every visit; the releases page shows the live fingerprint of the current deployment. A bundle altered in transit or targeted at a single user would surface as a visible mismatch.
Independent audit
This package is the exact audit perimeter we hand to third-party reviewers, and the same files our bug-bounty researchers work against. Found something? Responsible disclosure is rewarded.