Supply-chain transparency

Release Transparency

A zero-knowledge product is only as trustworthy as the JavaScript your browser actually runs. We publish a release manifest for every version so that high-stakes users can independently verify what was shipped.

Why this page exists

Client-side encryption protects your content from the server. But it does not protect you from a compromised client. If an attacker were able to swap the JavaScript bundle we deliver — at the CDN, build pipeline, or DNS layer — they could exfiltrate keys before encryption happens. We treat that as the single most dangerous threat to a zero-knowledge product, and we publish what we ship so it can be checked.

What this page covers

Release manifest

Every released version — application, REST API v1, and webhook delivery paths — is listed below with its date and release notes. The manifest is served from /releases.json at the same origin as the app — anyone can fetch it and compare with what they see in their browser.

Operational transparency

The manifest below is a public, independently checkable log of what we ship. It is not a cryptographic signature: we do not currently use offline-signed releases, and we say so plainly rather than imply stronger guarantees than we provide.

Currently served build

Live build-manifest fingerprint

Every build emits /build-manifest.json — the SHA-256 of every file this deployment serves (including the published encryption module). Below is the canonical fingerprint of that manifest — the SHA-256 of its sorted per-file hashes, recomputed in your browser right now. It uniquely identifies the exact set of files declared by this build manifest: two visitors served different code see different fingerprints. The integrity page re-fetches and re-hashes every script the page loaded and compares it against this manifest on every visit.

computing…

Release manifest

How to verify the manifest

Open DevTools → Network in your browser, refresh DRIVUNO, copy the URL of any .js chunk loaded.
Download that chunk with curl and compute its SHA-256: shasum -a 256 chunk.js.
Compare against the hash listed for the current version above.
If hashes do not match, do not enter your password — contact security@drivuno.com immediately.

Related transparency

Threat model — what we protect against and what we honestly do not.
Infrastructure & providers — where bundles are built and served.
Security changelog — human-readable security-relevant changes.