Supply-chain transparency
Release Transparency
A zero-knowledge product is only as trustworthy as the JavaScript your browser actually runs. We publish a release manifest for every version so that high-stakes users can independently verify what was shipped.
Why this page exists
Client-side encryption protects your content from the server. But it does not protect you from a compromised client. If an attacker were able to swap the JavaScript bundle we deliver — at the CDN, build pipeline, or DNS layer — they could exfiltrate keys before encryption happens. We treat that as the single most dangerous threat to a zero-knowledge product, and we publish what we ship so it can be checked.
What this page covers
Release manifest
Every released version — application, REST API v1, and webhook delivery paths — is listed below with its date and release notes. The manifest is served from
/releases.json at the same origin as the app — anyone can fetch it and compare with what they see in their browser.Operational transparency
The manifest below is a public, independently checkable log of what we ship. It is not a cryptographic signature: we do not currently use offline-signed releases, and we say so plainly rather than imply stronger guarantees than we provide.
Release manifest
How to verify the manifest
- Open DevTools → Network in your browser, refresh DRIVUNO, copy the URL of any
.jschunk loaded. - Download that chunk with
curland compute its SHA-256:shasum -a 256 chunk.js. - Compare against the hash listed for the current version above.
- If hashes do not match, do not enter your password — contact security@drivuno.com immediately.
Related transparency
- Threat model — what we protect against and what we honestly do not.
- Infrastructure & providers — where bundles are built and served.
- Security changelog — human-readable security-relevant changes.