Security, and what is inside each build.

The apps are not open source. So that you can still see what you are running, every release of IRIS, Navigaze and Fluent, and each server they talk to, publishes a software bill of materials and a vulnerability report. They are generated automatically from the exact build, and each file is machine-readable CycloneDX 1.5 JSON.

The current builds.

How to read them.

SBOM (.cdx.json): every package the build is made from, with version, licence, checksum and how they depend on each other. For an app, packages marked required ship in the build; packages marked excluded are build and test tools that stay on our machine. For a server, the list is exactly what ends up in the deployed code.
VDR (.vdr.json): the known advisories against those packages, checked with npm audit when the release was made. Each one carries a status. in_triage means it is in a package that ships and we have not yet judged whether it is reachable. not_affected means it is in a build tool that does not ship, so it cannot affect the release.
The first-party code of an app or server is one component with the checksum of the package we upload, or the commit it was built from. It is not itemised: the apps are not open source.
Advisories are published daily, so a report is a snapshot. A release that was clean when it shipped can have an advisory filed against it later. The next release shows it.
Nothing in these files is secret: package names, versions, licences, checksums and commit ids only.

What the apps do with your data.

Each app explains, in plain language, what leaves your phone and glasses, where it goes, how it is protected, how long it is kept and how to delete it:

Reporting a security problem.

Email [email protected] with “Security” in the subject, say what you found and how to reproduce it, and give us a reasonable time to fix it before you publish. Please report privately first and avoid touching other people’s data. The same details are in /.well-known/security.txt.