Cryptocat's private chat uses OTR. Our group chat function uses an open and studied multiparty protocol. Generally, our security bugs have been implementation errors much more than protocol design errors.
Surely, the best we can do as a community project is open up our code for more volunteers and experts to help and take a look. :-)
Surely, the best we can do as a community project is open up our code for more volunteers and experts to help and take a look. :-)