Security practice

The philosophy, the practice, the record, and an open call for independent auditors.

The philosophy

Security here starts from where things live. Your data stays on hardware you own, under your hand, and leaves it only when you send it. A system you can read, run and move yourself is one you can also check yourself, so the software is open source under GPL-3.0 and the claims on this site are written to be checked.

I build AI-augmented: a model writes code to my direction, and every architectural call and every security judgement stays mine. AI speeds the building up, and review is the part that has to keep pace, so the practice below is built around review: tests that prove a fix, checks that run before anything ships, and outside eyes invited in.

The practice

A threat profile for each project before it holds anything sensitive: what it guards, from whom, and which controls follow from that.
Checks before anything ships. Each build and each deploy runs through gates that refuse it on a known problem. Genius in a Bottle's installers are scanned for anything that belongs on my machine only, and every build is tried on Windows and on a Mac before it goes out.
Builds you can check. Both Android apps publish their signing key with every release, and BreathGate builds reproducibly: an independent build of the same source gives a byte-identical file.
Least privilege. Services run in locked-down containers: a read-only system, no added powers, reachable only from the machine they live on, with an encrypted tunnel as the one way in. Genius in a Bottle keeps every file it touches inside your vault folder.
Privacy by construction in The Wheel. Members prove they belong with zero-knowledge proofs, so a show-up, a vouch or a Going counts once and the person stays anonymous. Its tests run real proofs.
Encrypted backups, restored for real. Backups are encrypted to a key kept off the server, and a restore is part of the test, so a backup counts only once it has come back whole.
A fix starts with a test. A reported problem is first reproduced by a test, then fixed until that test passes, so the same problem stays caught.

The record

31 October 2026. An outside AI-assisted audit of the public code named two risks in The Wheel's member service. Both were confirmed the same morning. A damaged state file would have been read as empty and could then be saved over, and two requests arriving at the same moment could count twice. Four new tests caught each problem on the old code. My fix made the service stop on a damaged file and decide each request from the state as it stands after the proof check. All thirteen tests pass, and the fix was live the same day.

A call for independent auditors

An independent review is the next step, and it is welcome. If you audit software for security or privacy, the code is open: github.com/Aureliusxradix. Most useful to look at: The Wheel's zero-knowledge membership and its moderation, Genius in a Bottle's hold on the files it may touch, and RadiVoice's path from a phone to your own computer.

To report a problem, email aureliusxradix@pm.me with "Security" in the subject, or use Signal (the username is on How to reach me). Please give me a fair chance to fix it before you publish. Good-faith research that respects people's data is welcome here, and I will credit you on this page if you would like that. For a paid review, write anyway: I would rather pay for a careful one than wait for an accident.

Machine-readable: /.well-known/security.txt.