Security posture

Everything below is checkable from outside with curl. The machine-readable copy is /security.json; the contact of record is /.well-known/security.txt.

What this is

A Cloudflare Worker in front of static files. There is no origin server — no Apache, no nginx, no PHP, no application runtime, and no database reachable from a request path. Every page is a file written by an offline build and uploaded whole. There are no accounts, no cookies, no sessions, no forms and no uploads, so there is no credential of yours here to leak.

What it will not serve, and why

A security scanner walked this host on 2026-09-01 and took 404s on the paths below. They are 404 because the things they look for do not exist here — not because they are hidden somewhere else. This table is that scanner's own probe set, so the next one can diff its findings against our answer line by line.

PathWhat the probe tests forWhy it is 404 here
/server-statusApache mod_status scoreboardThere is no Apache here — this is a Cloudflare Worker in front of static assets, so mod_status does not exist to expose. The nearest real thing is this host's request log, and it holds other people's user-agents, referers and salted address hashes: it stays authenticated at /hits.json. The aggregate half is already public and unauthenticated at /stats.json, which is as much of the server's state as can be published without publishing our visitors.
/debugframework debug consoleNo framework, no interpreter, no debug mode. The pages are files written by a generator that runs elsewhere.
/adminadministrative interfaceThere is no admin interface, because there is nothing to administer at the edge: content is rebuilt and redeployed wholesale, never edited in place.
/dashboardoperator dashboardSame: no dashboard exists. /stats.json is the public read-only equivalent.
/_internalinternal-only routeNo route on this host is internal. Every path that answers is listed in /llms.txt, /sitemap.xml and /openapi.json.
/.envenvironment file with credentialsSecrets are Cloudflare Worker secrets, never files in the served directory. The assets directory is generated from a public dataset and contains no credential.
/.env.locallocal environment overrideSame as /.env.
/.git/configexposed version-control directoryNo repository is deployed. Only generated output is uploaded to the assets host.
/.git/HEADexposed version-control directorySame as /.git/config.
/config.jsonserver configuration leakageNo configuration is served. The only JSON here is the published dataset and the discovery documents, all of it intended to be read.
/appsettings.json.NET configuration leakageNo .NET, and no configuration served.
/package.jsondependency manifest leakageThe build's manifest is not deployed to the assets host.

/server-status is refused on purpose, and would be refused even if we ran Apache. A truthful server-status names in-flight request URLs and the addresses of whoever is being served — other people's traffic, not ours to publish. The aggregate half of that question is already answered, unauthenticated, at /stats.json; the per-request half stays behind a token at /hits.json because those rows carry visitors' user-agents and salted address hashes. Serving a fabricated scoreboard to score well on a scan would be a lie about the stack, and serving a real one would be a disclosure at our visitors' expense.

No soft 404s

A path that does not exist returns a real 404, never a 200 carrying an apology. If you probed a nonsense path to calibrate, the answer you got was honest and the rest of your findings can be trusted against it.

The one tool that makes an outbound request

Of the three MCP servers and one A2A agent on this host, exactly one tool fetches anything: check_discovery_documents on /mcp/doctor. It refuses before making any request — this host and its subdomains, the hostname the request arrived on, localhost, every bare IP literal, internal TLDs and ephemeral preview domains — so a refusal means no packet was sent, not that a response was filtered. HTTPS only, one GET per path, byte-capped and timeout-bounded, identified as agent-discovery-doctor/1.0. The other two servers take no URL argument at all, and their test suite asserts it. A fetch tool published by someone who counts their own requests is otherwise both an SSRF proxy and a way to manufacture their own traffic.

What is logged about you

One row per request: time, path, query, user-agent, referer, accept header, and a salted hash of your address. The raw address is never stored and never served. Aggregates are public at /stats.json. The raw rows are behind a token — not to hide our numbers, but because they carry other visitors' user-agents and address hashes. No third-party trackers, no analytics vendors, no cookies.

Reporting something

Vulnerability reports, data corrections and takedown requests all go to pathwren@tutamail.com or /about.html. A wrong robots.txt token or a stale IP prefix makes somebody's block fail open, so corrections to the data are treated as security-adjacent and handled the same way. We will not publish an ownership token, a session credential or a connector key as proof of anything, at any path.