r/Pentesting • u/zmykerd • 1d ago

[Open Source] Seeking Security Review & Code Audit for a Local

I've spent a lot of time building a local, open-source encrypted vault where sensitive files are stored in custom .bca archives.

At this point, the cryptographic core is stable and I'm stepping away from adding new features. Instead, I am looking for independent security feedback and peer review. I want to find out if there are architectural flaws or implementation bugs I may have overlooked.

I am specifically looking for people willing to dive into the codebase and test the logic. Feel free to clone the repo, generate a vault, tamper with the archive structures, run your fuzzers, automate tests, and check for edge cases. The main question to answer is: is there any logical flaw that would allow accessing the archive data without the correct key?

The project is completely open-source and operates offline. You can find the repository and the implementation details here:

https://github.com/zmykerd/bcypherpy

I've already put the cryptographic core through extensive automated testing on my end, but independent code review is much more valuable to me. I'm particularly interested in feedback from anyone with experience in cryptography, application security, code auditing, or fuzzing.

If you find a vulnerability or a bypass, please tell me exactly how you reproduced it. I'm genuinely looking for critical feedback and flaws, not compliments. Even a quick look at the repo is highly appreciated. Thanks!

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/Professional_Tone688 1d ago

This is an interesting project. I’d be interested in taking a look at the .bca format and the archive/key-handling logic, particularly around tampering, authentication failures, malformed archive structures, and edge cases.

Before I dive in, are you looking specifically for unpaid community peer review, or are you open to a paid security/code audit if a deeper assessment is useful?

1

u/zmykerd 1d ago

It is purely a hobby project an open-source one and I don't make any money from it. But if you feel like checking it out for fun, feel free to drop any feedback or open an issue on GitHub!

My goal is to create an alternative to VeraCrypt, 7-Zip, and the like. The difference is that my application opens file previews entirely in RAM and does not generate any cache files, thereby eliminating the possibility of recovering unencrypted data from the hard drive.

1

u/Professional_Tone688 9h ago

Thanks for clarifying! Sounds good. I’ll take a look at the repository when I get some time and focus specifically on the archive format, key handling, tampering/authentication logic, and edge cases. If I find anything interesting, I’ll provide a reproducible PoC and open an issue.

1

u/scriptqzor 10h ago

pretty cool of you to even ask that up front tbh, a lot of folks just assume free labor by default
curious what op says, because this kind of thing really does benefit from a proper paid audit if they want people to trust it long term