Relim

Security

Security & source

Where to send a vulnerability, where Relim's security actually stands, and what you can and cannot verify about a build you have installed.

Reporting a vulnerability

Report it privately first, and give us a chance to fix it

If you have found a security problem in Relim, please report it privately first, and give us a chance to fix it before it is public.

Where to send it
k@alvorado.co
We do not publish a PGP key yet. If your report needs an encrypted channel, email us first without the details and we will agree one with you.
What helps
The app version and platform, what you did, what happened, and what you expected. A minimal reproduction is worth more than a long description. If you have a patch, even better.
What to expect
Relim is a very small project. We will acknowledge your report and tell you honestly whether and when we can fix it, rather than leave you waiting. We will credit you when a fix ships unless you would rather we did not.

  • In scope

    • The mobile app, and the Rust core it is built on
    • The relay, wake service, network-manifest service and call relay
    • The cryptographic protocol design and its implementation
    • This website

  • Please do not

    • Run denial-of-service or load tests against the public relays — other people's messages queue there. Once the source is published, run your own and test that.
    • Access, modify or exfiltrate other people's data. If you find you can, stop and tell us; that is the finding.
    • Report findings against third-party services (Apple, Google, Zcash nodes) to us — report those to them. We are happy to hear about how Relim uses them.

Where Relim's security actually stands

Two things it would be dishonest to leave out

  • Relim has not had an external security audit

    Its cryptography is built out of audited libraries taken whole — OpenMLS for the group messaging protocol, RustCrypto primitives, librustzcash for the wallet — and it deliberately implements no ratchet, no AEAD and no handshake of its own. But the code that glues those together has been reviewed only by the project itself.

  • It is pre-release software

    Do not treat it as a tool your safety depends on until it has been audited and has run in the world for a while.

Some design decisions are deliberately conservative and are worth knowing: no unsafe code is permitted in the cryptographic crates, key material never crosses into the user-interface layer, and the seed never leaves the Rust core or the device.

Reproducible builds

Where this honestly stands

Relim's builds are not reproducible today, and we are not going to imply otherwise.

The goal is that anyone can rebuild the published app from source and get the same bytes, so a signed binary can be checked against the source rather than trusted. Relim does not meet that goal. The blocker is measured, not suspected: one of the native audio/media archives the app links does not rebuild byte-for-byte even on the same machine with an identical toolchain, and the cause is not yet understood.

Until that is fixed, "verify the source matches the binary" is not something you can do with Relim, and no page on this site will claim you can. What you can do today is check that the APK you have was signed by the certificate we publish — see Verify what you downloaded. That is a weaker property, and we would rather name it correctly than round it up.

Source code

The source is not public yet. It will be published as open source; until it is, there is no repository address to give, so none is stated here. This page will carry the address when it exists.

The repository contains the whole system: the Rust core, the Flutter app, the relay, the wake service, the manifest service, the call relay, the deployment scripts, and this website.

Licence

All Relim source is dual-licensed:

  • MIT — LICENSE-MIT in the repository root
  • Apache License 2.0 — LICENSE-APACHE in the repository root

You may use it under either licence, at your option. In SPDX terms: MIT OR Apache-2.0.

Contributions are accepted under the Developer Certificate of Origin 1.1 — sign off your commits with git commit -s. There is no contributor licence agreement and we do not ask you to assign copyright.

The licence permits a fork. It cannot stop a modified fork calling itself "Relim" and shipping something weaker, which is why the name matters and why you should check where you downloaded from.

Running it yourself

Every server Relim uses is in the same repository and is meant to be self-hosted: the relay, the push wake service, the signed network manifest, and the call relay. A self-hosted deployment removes the default operator from the picture entirely. The app points at whichever signed manifest you tell it to.