Small team. Serious adversary.
We build metadata-private communication for people whose opponent is a state, not an advertiser. That sentence sets the bar for the work, and for who we are looking for.
We are not hiring.
Avano is founder-led, self-funded and pre-release. We are not going to post roles we cannot fund or invent a headcount to look larger than we are — that would be the same defect as an overstated security claim, applied to a person's career.
What we can do is be honest about the shape of the team this eventually needs, and hear from people we should be talking to when the time comes.
Directions, not job postings.
Each is a real gap between what Avano is and what a metadata-private messenger has to be before anyone should trust it with their safety. All four are named honestly on the roadmap as things we have not done.
Systems & cryptography
Rust, near applied cryptography and protocol design. The specific temperament that matters here is distrusting a green test until you have watched it fail — and then checking that the break you introduced was actually applied, because a no-op edit and a correct test produce identical output.
iOS & Android
Native mobile work to bring iOS from compiling to carrying messages, and to narrow the endpoint surface — including moving the interface off the system web view, which is where we are currently behind Signal.
Verification & release integrity
The largest gap in the product is not the protocol, it is the path between our machine and your phone: signing, reproducible builds, a public log, and a verifier that runs outside the app. Somebody whose instinct is to check the artefact rather than read the exit code.
Relays & infrastructure
Standing up a genuinely independent, multi-jurisdiction relay network. This is the one part of the design that money and relationships unlock rather than code — every diversity mechanism we have written is worth exactly nothing until there are real independent operators.
Three things you would find unusual.
- A well-argued refusal is worth more than a fix. Recently a feature that would have let a locked app receive mail was refused, because filling it required caching the queue-draining credentials outside the sealed store — "anything that keeps polling while locked has not locked." A durable disk spool on the relay was refused because "a RAM image captures the present; a disk image captures the past." Both were right and both were worth more than the feature would have been.
- If a briefing you are given is wrong, say so and stop. That has happened repeatedly here and it has always been the right call — including when the wrong instruction came from the person coordinating the work.
- Record the mistake rather than quietly correcting it. Several of the most useful comments in this codebase exist because somebody wrote down what they got wrong on the way. A correction that does not say why the wrong version looked right will be undone by the next person.
Introduce yourself.
No form and no funnel. Tell us who you are, what you would want to work on, and why this. We read every one, and we may be slow.
One address, deliberately — here is why. A departmental address we have not confirmed reads mail is a trap with our name on it.