Every claim, labelled: why our security page lists what we don't promise

I build Vardum, a private messenger, mostly on my own. Early on I made one rule for the website: every security claim goes on a single page, with its limits next to it, and if any other page disagrees with that one, that page wins.

It's at tryvardum.app/claims/. Each entry has an ID and one of four labels:

• Implemented: in the build testers have now.
• New: recently added, with a caution note.
• Verified, not claimed: tested on our own phones, not in a released build yet.
• Not claimed: things we deliberately don't promise.

The last group is the one I'd point another developer to. There are ten entries. A few of them:

• NC-02, trace-free operation on the phone. Operating-system leftovers, backups and live memory are outside any app's full control.
• NC-03, network invisibility. Vardum needs no phone number or email, but the server still sees IP addresses as requests arrive, timing and sizes. We publish exactly what at tryvardum.app/who-can-see-what/
• NC-05, completed independent assurance. The cryptography is self-reviewed. An independent audit is planned for early 2027, and this entry changes when the report is published.
• NC-07, a duress wipe nobody can notice. The duress password erases Vardum and goes back to the start screen. Whoever is holding the phone can tell.

Writing these down has changed how I build. If a feature can't be described honestly in two sentences with its limits, it isn't ready to go on the page.

The code is public under AGPL-3.0: github.com/VardumTechnology/Vardum. If you find a claim the code doesn't back up, tell me at [email protected] and the page changes.