Built against the record, and audited against itself.
Avano's users' adversary is a state, not an advertiser. That sentence decides every trade-off, and it came from reading what states actually did to the encrypted phones before this one: EncroChat, ANOM, Sky ECC, Exclu, Ghost. This page is the record we built against, where that leaves us honestly, and what the audits of our own code found and fixed, with counts.
Every encrypted phone that fell was taken by the same door: the update channel.
EncroChat in 2020 was taken through its update channel: the operator's servers pushed an implant to every handset. ANOM, from 2018, was the platform itself, run by the police from the start. Sky ECC in 2021 fell by a third method again, and Exclu, Ghost and MATRIX after it converged on the same two lessons: the party that can push code to the phone owns the phone, and a platform that holds the keys is a platform that can be made to hand them over. Alongside those, the general answer to any secure messenger is the endpoint: exploit the phone and the encryption is beside the point. And in more than one prosecution the metadata alone, who talked to whom and when, was the case.
The full reading, with sources, is in the published repository as the threat-model state document. It is the reason Avano holds no keys, keeps no record of who talks to whom, and treats its own build and update path as the most dangerous thing it operates.
Would each of those work here? Asked plainly, answered plainly.
The update channel. Yes, it would work, and the document calls it its worst finding: a signed release is what stands between a phone and a targeted build, so the signing key is kept off every machine, every push to the source carries a signed record in a chain, the build is being made reproducible in the open, and a transparency log of releases with clients as witnesses is designed and built. None of that is finished until the first signed release, and this page will say when it is.
Compelling the operator. The relay holds numbered slots of sealed, same-sized blocks in memory and nothing else; a compelled operator hands over the sentence that describes that, and the two-leg split makes one relay's answer half of nothing. Today one company runs every relay, which the company page states as a weakness rather than leaves implied.
Being the platform. The source is published and the protocol is specified and pinned by vectors, so a second implementation and a second operator can exist and check us; until they do, that is a promise with a record behind it, not a fact.
The endpoint. It works, as it works against every messenger. Behind the passphrase the phone's store is sealed and the keys are gone from memory unless the person chose alerts; a seizure yields sealed bytes. Against a live exploit on an unlocked phone there is no defence here and we do not claim one.
Metadata. Structurally the strongest part of the design: no account, no number, no list, cover traffic at a steady rate, and the relay seeing a Tor circuit and a numbered slot. The residual leaks are counted on limits.
Where Avano is still weaker than Signal, kept as a list.
The threat-model document keeps a section with that exact title and the ranked work that follows from it. The short version today: a smaller team, no external audit yet, no signed release yet, no second operator, no reproducible build of the whole app confirmed, and a younger code base in every component that Signal has run for a decade. Where Avano is stronger is in what it never collects. We would rather be judged on both lists than on one.
What the audits of this code found, with counts.
Every audit below was done by reading the code against its own claims, verified by running, and fixed with a test that was watched failing against the broken code first. The reports are in the published repository, each with its table of defects and the change that fixed each one.
The claims audit and the first red team
Every security claim on the site and in the documents checked against the code. Several overstated claims were retracted, and a guard now refuses any retracted sentence from returning anywhere on the site.
Two microscopic audits, then forty-five defects in two waves
Eighteen defences that were designed, implemented, tested and called by nobody were found in one day in July and wired; the August audits found seven live defects, then forty-five more across two waves, from a vanished padding to a notification that never reached a modern contact. Twenty-two further leads were re-checked afterwards: what survived, what was refuted, and twelve fixes deliberately not applied, with the argument for each.
A defect hunt, a screen audit, the protocol written from the code
Twenty-one findings from a defect hunt across the engine, all fixed; every screen audited for anything that was a mock rather than real; and the protocol specification written section by section from the code, which was itself an audit: most sections record an overclaim found while writing them.
The guards
About a hundred and thirty source guards run before every commit: that every security module has a production caller or a written reason, that a retracted claim stays retracted, that every panic site in shipped code has been read, that the site says nothing the permissions contradict, that every pinned address comes from one profile. They have been corrected by findings from outside them more than once, which is the point of writing that down.
Do not claim what you have not checked.
The dominant defect in this code base, found eighteen times in one day, was a defence that was designed, implemented, documented, tested and called by nobody, with every test green because the tests called it even when nothing else did. The rule that followed is the first line of the engineering handbook: nothing is claimed that has not been checked by an artefact, never by a green line. Every "built" on this site is a thing with a test that was watched fail first; every "live" names a machine; every "not deployed" is written where the thing is not deployed. The company page says the same rule from the other side.
No external audit has been done. It is on the launch list, after the source is published and the build is reproducible.
An audit of an unpublished, unreproducible build tests the wrong thing, so the order is: the source public, the build reproducible and the release signed and logged, then the audit. An auditor who wants to start earlier finds everything above in the repository and a way to report a flaw. We will name the auditor and publish the report when there is one.