The source I have is just like the Lua that runs the website. Everything else is standards based and totally open source. As I say in the about page, I'm using:

http://srp.stanford.edu/ as the protocol, specifically SRP6a but with a SHA256 since I couldn't get a MGF1 to work in javascript. Probably change that later.

http://srp.stanford.edu/download.html as the actual implementation. Yes, I'm using that C library.

http://crypto.stanford.edu/sjcl/ for the javascript crypto, also written by the same people doing SRP.

And you can read the javascript files on the site to see what it's doing.

So, it's based on entirely standards based (even has an RFC) open source protocols and uses implementations from the actual authors of said protocols.

The closed source part is just my lua Tir stuff and whatever else I make.