Public security status
Babili security status and limitations
Babili is an early-stage encrypted messenger, not an audited high-assurance security product. This page puts its current guarantees, known gaps, and review routes in one place.
Current status
- No independent security audit has been completed.
- Message and file content is encrypted and decrypted in participant browsers.
- The room secret is carried in the URL fragment during normal use, so it is not sent to the server in an HTTP request.
- The Cloudflare relay handles ciphertext and does not persist a server-side transcript.
- Protocol v3 signs peer events with admitted ephemeral session keys, rotates room keys on membership changes, and retains bounded replay IDs across refresh in the same tab.
What the relay and participants can still know
The hosted relay can observe ordinary network and room metadata, including IP addresses, connection timing, presence, and encrypted payload sizes. Encryption does not make the service anonymous.
A participant can save, copy, screenshot, photograph, forward, or back up plaintext and files. Room destruction ends Babili's server-side room lifecycle; it cannot erase copies on participant devices or from other software.
Where it does—and does not—fit
Babili is being built for temporary communication between known participants who want fewer durable server-side copies. It should not currently be treated as an anonymous drop box, an audited high-risk communications system, a compliance product, or a production financial-control system.
Use a purpose-built, independently reviewed system when anonymity, severe-repression resistance, regulated recordkeeping, or high-assurance identity verification is required.
Inspect and challenge the claims
- Read the threat model
- Inspect the architecture
- Review the complete AGPL-3.0 source
- Join the public independent-review request for coordination and non-sensitive design observations
No independent reviewer is currently committed. The public request is an invitation to scrutiny, not a claim that an audit is underway.
Report a suspected vulnerability privately
Do not publish exploitable details in the review issue. Follow the security policy and use GitHub private vulnerability reporting.