Read the important part.
Encryption you can't inspect is a promise, not a property. Here's exactly what's inspectable today, and what's on its way.
Auditable today: the viewer
The page every recipient opens is a single self-contained file — no frameworks, no bundler output, no external scripts. Open any note link, hit View Source, and you're reading the entire program that handles the key from your link: the WebCrypto key derivation, the AES-256-GCM decryption, the strict Content-Security-Policy that forbids it from talking to anything but this server. That isn't a substitute for a repository, but it does mean the code that touches your secrets is public in the most literal sense on every single note.
Boring on purpose
BurnPony doesn't invent cryptography. It uses AES-256-GCM for sealing, HKDF-SHA256 for key derivation, and PBKDF2-HMAC-SHA256 at 600,000 iterations for passphrases — standard primitives, used the standard way. The Swift implementation in the app and the JavaScript implementation in the viewer are verified against each other with independently generated test vectors, so the two codebases have to agree byte-for-byte to work at all.
The repository
It exists, and this page now points at it: github.com/norsehorse-dev/BurnPonyiOS — the complete iOS app, the relay server, the viewer with the parts it's assembled from, the cross-implementation test vectors, and a self-hosting guide, under the Apache 2.0 license, on the same account that hosts the family's other published cores, including PGPonyCore and RelayPonyCore. The exact byte-level format is written up as the v1 protocol, and the shipped viewer is provably identical to its published source: scripts/assemble_viewer.py --verify in the repository checks it byte for byte.
Why this order
- Recipients first: the code recipients must trust — the viewer — is the part that's inspectable from day one.
- Claims you can test: the fragment-key design means "the server can't read notes" is checkable from the outside: watch the network tab and see that the fragment never leaves the browser.
- Honesty over optics: the site says "planned" until the repos exist. When they do, this page gets the links and the license terms.
In the meantime
Security questions or findings are welcome now, repository or not: NorseHorse@norsehor.se, encrypted via the PGP key if you prefer. The security page documents the full model in the open.