Labs / Cipher
Cipher security model — public boundary
This page defines which Cipher claims belong on the corporate site and which must come from the current project implementation and release documentation.
Authoritative source
The corporate website is not the authoritative specification for Cipher cryptography. Implementation details, threat assumptions, test vectors, verification behavior, and release-specific claims must come from the current project repository and release documentation.
Stable public statements
- Cipher is separated from the main corporate marketing site.
- The Cipher surface should not load advertising, marketing analytics, or unrelated third-party JavaScript.
- Verification and support operate on separate hostnames.
- Security claims must remain traceable to tested implementation details and stated assumptions.
Why the boundary exists
Cryptographic systems evolve. Keeping release-specific details with the implementation reduces the risk that a marketing page silently becomes an outdated specification.