A security claim you cannot check is marketing. The protocol
is published in full, the test vectors are in the repository, and the
threat model states the limits as plainly as the strengths.
What Z is designed to withstand
A hostile or seized relay: it holds only ciphertext, in RAM,
addressed to hashes — and with sealed sender it cannot tell who sent
what.
Recorded traffic decrypted later, including by a quantum
computer: key agreement is hybrid X25519 + ML-KEM-768.
A stolen key: the double ratchet moves keys forward
constantly, so a compromise reaches neither past nor future messages.
A substituted key: safety numbers let two people detect it
themselves, and device-list changes are gossiped between contacts so a
silently added device is visible.
A lost device: the vault is encrypted, optionally behind
biometrics or a passphrase, and can be wiped.
What it cannot do
These are real limits, not hypotheticals, and they are in the published
threat model rather than buried:
A compromised device defeats everything. Disappearing
messages and local encryption protect a lost phone, not one running an
attacker's software.
The relay sees transient metadata. IP addresses,
timing and padded sizes pass through memory. Z does not record or analyse
them, and nothing is stored to hand over — but a network observer still
sees that a device is talking to a relay.
Trust starts out of band. If a contact code is
swapped before it reaches you, you verified the wrong person. That is what
safety numbers exist to catch.
No public transparency log yet. Device changes are
gossiped between contacts today; a third-party-auditable log is designed
but not built.
Group membership is asserted by the group's admin
over their authenticated channel — there is no cryptographic group
state.
How the claims are checked
The wire protocol is frozen and specified byte by byte, and pinned by
known-answer test vectors. Those vectors are reproduced on every change by
three independent implementations: the app's own, a clean-room implementation
written from the specification alone that shares no code with it, and
reference implementations of the post-quantum primitives. If any of them
disagrees, the build fails.
Independent audit
Z has not yet had an external security audit. The scope brief and
the threat model are published so that one can start from a clear statement
of what is claimed. We would rather say this plainly than imply an assurance
that does not exist.