Seglamater Code

Source-available code from an independent security and software studio.

Security for the people.

What this is

code.seglamater.app is where we publish the source for the software we build. Seglamater is a small, independent studio working on security and privacy tools. This is not a mirror of everything we touch — it is a curated set of the projects we are comfortable putting in front of you to read, build, and check for yourself.

We think transparency is a feature, not a marketing line. The most honest thing a security vendor can do is show you the code. So we do. What runs our own products is, wherever we can manage it, the same code you can read here.

Why we do it this way

You can audit it. Claims about privacy and security are cheap. Source you can read is not. If we say a scanner does not phone home, or that an agent cannot take an action without authorization, the code is here to confirm it.
We use what we ship. These tools run our own estate before they reach anyone else. Dogfooding keeps us honest — a bug that would annoy a customer annoys us first.
Source-available, on clear terms. Each project states its license plainly (see below). Where a tool is fully open, it is genuinely open. Where a license restricts commercial use for a period, we say so up front rather than burying it.

Published today

hivemind

A self-hostable, multi-agent orchestration server with a code-enforced tool-authorization harness. It runs LLM-powered agents against real systems under a default-deny model: an agent cannot take an escalated action unless it is explicitly authorized, with human-in-the-loop approval and egress protection built into the core rather than bolted on. Written in Rust. License: Business Source License 1.1 — source-available for reading, building, and evaluation; converts to Apache 2.0 in time.

sps

An open-source privacy scanner that grades a website against the Seglamater Privacy Standard. It scores a site from 0 to 100 across categories like transport security, security headers, tracking prevention, cookie handling, and email/DNS hygiene, and returns a letter grade. Runs as a command-line tool, an API, or on a schedule. Written in Rust. License: GPL-3.0 (the specification itself under CC BY 4.0) — fully open source.

kb

A self-hosted content platform — a combined blog, bookmark manager, and technical writeup collection with reader comments, built security-first. Written in Python on FastAPI and PostgreSQL. License: AGPL-3.0 — fully open source, with network-copyleft: run a modified copy as a service and you share your changes.

chatalot

The end-to-end-encryption core of our encrypted chat platform — a clean-room Rust implementation of the Signal-family protocols (X3DH key agreement, Double Ratchet, Sender Keys for groups, ChaCha20-Poly1305 AEAD, Ed25519 identity) built on audited primitive crates, with a WASM build so the same code runs client-side in the browser. This is the crypto layer only; the surrounding server, transport, and client app are not included. License: Business Source License 1.1 — source-available for reading, building, and evaluation; converts to Apache 2.0 in time.

vantage

The published subset of our privacy-first business dashboard: the client-side cryptography crate, the connector SDK, four data connectors (Stripe, Google Workspace, Wave, Plane), and the encrypted-blob storage hub. Business data is encrypted on the user's own device before the hub ever sees it, so the hub stores and quota-meters ciphertext it can never read. The desktop dashboard client itself is a separate, unpublished component. License: Business Source License 1.1 — source-available for reading, building, and evaluation; converts to Apache 2.0 in time.

spawn

A capability-secured orchestration engine for fleets of AI coding agents: a commander/manager/worker hierarchy coordinated through a typed, deny-by-default authorization gate, with every decision appended to a per-principal, hash-chained, tamper-evident audit log. Includes a stdio MCP server so an agent gets a typed interface to the fleet instead of screen-scraping a terminal. This publishes four of the six crates (the core engine, CLI, MCP server, and terminal cockpit); a remote control-plane listener and a proprietary messaging bridge are omitted. License: Business Source License 1.1 — source-available for reading, building, and evaluation; converts to Apache 2.0 in time.

atlas

The authentication and authorization core of our internal customer ledger: scoped, 256-bit machine tokens that are SHA-256-hashed at rest, carry a least-privilege scope allowlist with no delete or token-management scope, and return 404 rather than 403 on a foreign resource so the status code cannot be used to enumerate customers. Written in Python on FastAPI and async SQLAlchemy. License: Business Source License 1.1 — source-available for reading, building, and evaluation; converts to Apache 2.0 in time.

ward

A read-only guardrail-integrity monitor: it continuously verifies that the enforcement hooks and approval gates guarding an AI agent's risky actions are still exactly what the operator blessed — un-forged, un-drifted, and still wired in. Ward holds no signing key and can mint no baseline of its own; it only compares live state against an operator-signed baseline and reports the diff, so a compromised monitor can never bless its own tampering. License: Business Source License 1.1 — source-available for reading, building, and evaluation; converts to Apache 2.0 in time.

On the licenses

Most of what's here is under the Business Source License 1.1: hivemind, chatalot, vantage, spawn, atlas, and ward. The source is open for you to read, build, and evaluate now; production use requires a commercial license until each project's Change Date, at which point it converts to the Apache License 2.0.

The rest is fully open source under copyleft terms: sps is GPL-3.0 (its specification is CC BY 4.0), and kb is AGPL-3.0 — read, run, modify, and redistribute on those terms, with AGPL's network clause meaning a modified copy run as a service must share its changes.

Each repository carries its full license text. Read it before you build on top of us.

Elsewhere

seglamater.com — the products, what they do, and how to reach us.
docs.seglamater.app — documentation for the tools published here.

showcase