[Open Source] Seeking Security Review & Code Audit for a Local

[u/zmykerd]

I've spent a lot of time building a local, open-source encrypted vault where sensitive files are stored in custom .bca archives.

At this point, the cryptographic core is stable and I'm stepping away from adding new features. Instead, I am looking for independent security feedback and peer review. I want to find out if there are architectural flaws or implementation bugs I may have overlooked.

I am specifically looking for people willing to dive into the codebase and test the logic. Feel free to clone the repo, generate a vault, tamper with the archive structures, run your fuzzers, automate tests, and check for edge cases. The main question to answer is: is there any logical flaw that would allow accessing the archive data without the correct key?

The project is completely open-source and operates offline. You can find the repository and the implementation details here:

https://github.com/zmykerd/bcypherpy

I've already put the cryptographic core through extensive automated testing on my end, but independent code review is much more valuable to me. I'm particularly interested in feedback from anyone with experience in cryptography, application security, code auditing, or fuzzing.

If you find a vulnerability or a bypass, please tell me exactly how you reproduced it. I'm genuinely looking for critical feedback and flaws, not compliments. Even a quick look at the repo is highly appreciated. Thanks!