Development log 03: the validation work still ahead

23 October 2026 · By V. The project is still an experimental beta. Publishing guides and passing internal tests do not complete its launch gates. This entry sets out the work still needed, without promising a release date.

VGuard: prove behaviour on Android

The first gate is a controlled comparison: the selected test app should lose fresh network access while an unselected app retains it, then regain access after stopping the firewall. Follow-up cases include DNS, IPv6, network changes, sleep, revocation and background lifecycle. Host stubs and parser tests do not substitute for the Android operating system.

V Cipher: test the complete physical workflow

Two real phones need to complete contact and message transfer, QR scanning, interruptions and recovery. A decoder handling synthetic images does not prove camera quality, permissions or device isolation. The protocol has no forward secrecy and replay history lasts one unlocked session; these remain explicit limits.

Browser tools: check the browser and OS boundary

Offline setup, clipboard handling, file saving, session clearing and recovery need practical checks on supported phone browsers. A clear interface cannot guarantee that an OS keyboard, extension or compromised endpoint leaves no copies.

Independent scrutiny

Internal adversarial testing is useful but is not independent review. A future review needs a defined source revision, scope, published findings where appropriate and evidence that fixes were retested. We have not completed an independent security audit.

How to contribute a useful result

Use synthetic messages and a spare test device. Record the app version, OS/browser version, exact steps and observed outcome. Do not include passwords, keys, private conversations or personal traffic logs. Submit ordinary test results through private feedback and sensitive findings through the vulnerability reporting route.

Read the current approach and limits · Start with the Android checklist