Source & Licenses
Verify us without reading the source.
QERYX's security argument is source-shaped: primitives you can name, logs you can query, builds you can hash. Here is exactly what is open today — and what is not yet.
Check these without asking us
A meaningful part of the trust argument is already public and checkable by anyone, right now — no repository required.
| Artifact | Where | What it proves |
|---|---|---|
| Protocol whitepaper | /security/whitepaper | The complete protocol, citable |
| Transparency endpoints | /docs/api#transparency | Key-log inclusion proofs, signed audit receipts |
| Conformance evidence | /trust | CNSA 2.0 / FIPS posture with deviations enumerated |
| Release verification | /docs/reproducible-builds | Signed manifests, byte-identical hash path |
| In-browser demos | across this site | Real ChaCha20-Poly1305 (RFC 8439), compiled to WebAssembly |
The demos on this site run a demo build — the same primitive family as the QERYX protocol, not the shipped crypto-core module. Each demo says so beside its output.
Take the review path
The library and the protocol implementation are source-published for review: evaluators, auditors, and procurement reviewers receive the source, the protocol specification with per-claim citations, the normative label catalog, the signed CBOM, and pinned test vectors.
There is no public QERYX repository today. When one exists, this page will link it — the claim ships when the repository does, and not before.
Who qualifies for review access
Security evaluators, government procurement reviewers, and independent auditors engaged through procurement or the bug bounty's deeper scopes. Review access is an agreement, not a download button — that is what review-gated means.
Read the licenses off the tree
Stated as they exist in the source tree — SPDX headers and license files, nothing implied.
| Component | License |
|---|---|
| crypto-core (Rust library) | Proprietary — SPDX headers in-tree, all rights reserved |
| qeryx-backend (relay) | Proprietary — SPDX headers in-tree, all rights reserved |
| iOS / Android clients | Proprietary — all rights reserved |
| MixcoatlDB | Apache License 2.0 file in-tree |
| GlyconCache | Apache License 2.0 file in-tree |
Know the direction of travel
The distribution plan includes an independent rebuild-from-public-source channel, which requires the client source to be public. That is the committed direction. Dates ship when they are real — a roadmap is labeled a roadmap.
Why not open everything now?
Because a repository is a claim, and we publish claims in the order we can stand behind them: the evidence first, source access for reviewers now, public code when the review program opens it. The sequence is discipline, not reluctance — the same discipline that keeps every badge on this site gated until it is true.
05The direct questions — answered without a hedge
Ask it directly.
Is QERYX open source?
No — not in the public-repository sense, today. The source is published for review under the program above, the protocol and conformance evidence are public, and builds are verifiable byte for byte. This page updates the day the answer changes.
How can I trust crypto I cannot read?
You can read the protocol, verify the primitives' pinned test vectors, query the transparency log, check your build's hashes against the signed manifest, and compare safety numbers end to end. The server cannot read messages whether or not you trust us — that is the design, and every check above works without our cooperation.
I found a vulnerability — where do I send it?
Responsible disclosure, with a safe harbor for good-faith research. Scope and rewards live at the bug bounty.