Open source and verification
The web tool is not open source today; this page names what you can inspect now and what is planned for Beacon.
Open source
Last updated .
Trust is stronger when you can inspect the implementation. This page lists what can actually be inspected today, and it separates that from the parts that are still only planned.
What you can verify today
The web tool that runs on this site is not open source. Its source code is proprietary and is not published, so you cannot read how it encodes or reroutes an image. What you can verify today is the observable behaviour: the page's Content-Security-Policy, the network requests a tool makes in your browser, the one anonymous count ping on download, and the served preset files, each signed with a hash so a client can check the rule it cached. You can read the security page for how to do that in your browser's network panel.
Beacon (planned)
IndoImage Beacon is the component that is intended to be open source. Beacon is a small app planned to keep selected files available for direct sharing from your own computer. When Beacon ships, its source repository, its licence, its releases, and its build instructions are planned to be published, so the code that handles your files can be read and rebuilt by anyone. A published repository, a signed download, and a release to verify do not exist yet; this page will link them only once they are real.
The protocol and the audit (planned)
The transfer protocol is planned to be documented publicly, with a compatibility policy, so a reader can see how a peer authenticates and how the transport is encrypted. An independent security audit and a reproducible build process are also planned. Until an audit has happened and its findings are published, this page will not claim that one exists. If you find a problem, the report address in the footer reaches us directly.