Ackaia may publish portions of the CipherDrive™ cryptographic engine as source-available software. The goal is to let users, developers, and security researchers inspect important cryptographic behavior and compare the implementation with Ackaia's public security claims.
A zero-knowledge product asks users to trust a client to handle sensitive cryptography correctly. Making relevant components inspectable can improve transparency by allowing independent review of areas such as:
key generation;
metadata encryption;
file-key wrapping;
chunk encryption;
sharing helpers;
protocol documentation;
test vectors;
security notes.
Source-available means code can be published for inspection under a license chosen by Ackaia. It does not automatically grant every right commonly associated with an open-source license.
The applicable license may restrict commercial use, redistribution, modification, competitive deployment, or other uses.
Publishing cryptographic client components does not require Ackaia to publish every production system. The public repository may exclude:
production backend code;
internal infrastructure;
billing systems;
abuse-detection secrets;
deployment details;
operational credentials;
private security controls.
Some security and abuse-prevention mechanisms lose effectiveness if attackers can precisely reproduce or bypass private detection logic. Transparency about the existence and boundaries of a safety system does not require publishing every evasion-sensitive implementation detail.
No. Public code can improve inspectability, but security still depends on:
the actual code shipped to users;
build and deployment integrity;
protocol design;
correct browser cryptography;
server authorization and operational security;
endpoint security;
the absence or timely remediation of vulnerabilities.
Ackaia welcomes responsible security review. Researchers should follow Ackaia's current Responsible Disclosure Policy and the instructions in the CipherDrive whitepaper.
Researchers should not access data that does not belong to them, disrupt the service, exfiltrate secrets, or publicly disclose unresolved vulnerabilities before Ackaia has had a reasonable opportunity to investigate.
You do not need to audit cryptographic source code to use CipherDrive. The source-available model exists so that the product's important security claims can be examined by people with the expertise and interest to do so.
The goal is verifiability: security claims should be supported by documented architecture and inspectable implementation where appropriate, not only by marketing statements.