I build Vardum, a private messenger, mostly on my own. Early on I made one rule for the website: every security claim goes on a single page, with its limits next to it, and if any other page disagrees with that one, that page wins.
It's at tryvardum.app/claims/. Each entry has an ID and one of four labels:
- Implemented: in the build testers have now.
- New: recently added, with a caution note.
- Verified, not claimed: tested on our own phones, not in a released build yet.
- Not claimed: things we deliberately don't promise.
The last group is the one I'd point another developer to. There are ten entries. A few of them:
- NC-02, trace-free operation on the phone. Operating-system leftovers, backups and live memory are outside any app's full control.
- NC-03, network invisibility. Vardum needs no phone number or email, but the server still sees IP addresses as requests arrive, timing and sizes. We publish exactly what at tryvardum.app/who-can-see-what/
- NC-05, completed independent assurance. The cryptography is self-reviewed. An independent audit is planned for early 2027, and this entry changes when the report is published.
- NC-07, a duress wipe nobody can notice. The duress password erases Vardum and goes back to the start screen. Whoever is holding the phone can tell.
Writing these down has changed how I build. If a feature can't be described honestly in two sentences with its limits, it isn't ready to go on the page.
The code is public under AGPL-3.0: github.com/VardumTechnology/Vardum. If you find a claim the code doesn't back up, tell me at support@tryvardum.app and the page changes.
