Review the built system as well as the source

A source-code review can miss configuration, build, dependency or deployment behaviour outside its scope. That limitation can apply to human and automated review. An AI tool is not inherently unable to inspect a build flag, and finding such a flag does not prove that the actual firmware uses it in the way a reviewer assumes.

Ask what was reviewed: source revision, build configuration, released artifact, device behaviour and recovery process. Look for reproducible evidence and remediation checks. Do not attribute a particular incident to an AI audit failure without a documented review showing what the tool received and what it reported.

Why Defense in Depth Requires Independent Contingency Channels

Because no single code audit, AI scanner, or hardware device can guarantee 100% bug-free operation forever, your security architecture must implement Defense in Depth:

  • Layer 1: Multi-vendor hardware diversity or multisig signers.
  • Layer 2: Physical metal seed backups stored in secure locations.
  • Layer 3: An independent, self-custodied contingency channel (ZeroLatch Private Mode) for scoped key-rotation instructions, location guides, and heir handoffs.

What ZeroLatch Private Mode Protects — and What It Does Not

ZeroLatch Private Mode is engineered specifically for high-security key rotation runbooks and estate handoffs:

Private encrypts content in the browser with AES-256-GCM. A custom password uses Argon2id to derive its wrapping key; the generated ZeroLatch phrase uses a separate HKDF-SHA-512 derivation route. The Private secret is not stored by ZeroLatch. Account, recipient, scheduling and other operational metadata remain available to the service. A compromised browser or weak password can still expose content. The security page explains the current boundary.

ZeroLatch can deliver a scoped inventory and instructions after a missed check-in and safety period. It does not transfer assets, establish legal authority or confirm death. Simple permits authorised service-managed key recovery; Private requires a separate password or ZeroLatch recovery phrase. Neither option replaces an independent backup or a real recipient rehearsal. Start with harmless information and read the security model and backup checklist.

Build a Private Delivery Today →