Everything below is checkable from outside with curl. The machine-readable
copy is /security.json; the contact of record is
/.well-known/security.txt.
A Cloudflare Worker in front of static files. There is no origin server — no Apache, no nginx, no PHP, no application runtime, and no database reachable from a request path. Every page is a file written by an offline build and uploaded whole. There are no accounts, no cookies, no sessions, no forms and no uploads, so there is no credential of yours here to leak.
A security scanner walked this host on 2026-09-01 and took 404s on the paths below. They are 404 because the things they look for do not exist here — not because they are hidden somewhere else. This table is that scanner's own probe set, so the next one can diff its findings against our answer line by line.
| Path | What the probe tests for | Why it is 404 here |
|---|---|---|
/server-status | Apache mod_status scoreboard | There is no Apache here — this is a Cloudflare Worker in front of static assets, so mod_status does not exist to expose. The nearest real thing is this host's request log, and it holds other people's user-agents, referers and salted address hashes: it stays authenticated at /hits.json. The aggregate half is already public and unauthenticated at /stats.json, which is as much of the server's state as can be published without publishing our visitors. |
/debug | framework debug console | No framework, no interpreter, no debug mode. The pages are files written by a generator that runs elsewhere. |
/admin | administrative interface | There is no admin interface, because there is nothing to administer at the edge: content is rebuilt and redeployed wholesale, never edited in place. |
/dashboard | operator dashboard | Same: no dashboard exists. /stats.json is the public read-only equivalent. |
/_internal | internal-only route | No route on this host is internal. Every path that answers is listed in /llms.txt, /sitemap.xml and /openapi.json. |
/.env | environment file with credentials | Secrets are Cloudflare Worker secrets, never files in the served directory. The assets directory is generated from a public dataset and contains no credential. |
/.env.local | local environment override | Same as /.env. |
/.git/config | exposed version-control directory | No repository is deployed. Only generated output is uploaded to the assets host. |
/.git/HEAD | exposed version-control directory | Same as /.git/config. |
/config.json | server configuration leakage | No configuration is served. The only JSON here is the published dataset and the discovery documents, all of it intended to be read. |
/appsettings.json | .NET configuration leakage | No .NET, and no configuration served. |
/package.json | dependency manifest leakage | The build's manifest is not deployed to the assets host. |
/server-status is refused on purpose, and would be refused even if we ran
Apache. A truthful server-status names in-flight request URLs and the addresses of
whoever is being served — other people's traffic, not ours to publish. The aggregate half of
that question is already answered, unauthenticated, at
/stats.json; the per-request half stays behind a token at
/hits.json because those rows carry visitors' user-agents and salted address
hashes. Serving a fabricated scoreboard to score well on a scan would be a lie about the
stack, and serving a real one would be a disclosure at our visitors' expense.
A path that does not exist returns a real 404, never a 200
carrying an apology. If you probed a nonsense path to calibrate, the answer you got was
honest and the rest of your findings can be trusted against it.
Of the three MCP servers and one A2A agent on this host, exactly one tool fetches
anything: check_discovery_documents on
/mcp/doctor. It refuses before making any request —
this host and its subdomains, the hostname the request arrived on, localhost,
every bare IP literal, internal TLDs and ephemeral preview domains — so a refusal means no
packet was sent, not that a response was filtered. HTTPS only, one GET per path, byte-capped
and timeout-bounded, identified as agent-discovery-doctor/1.0. The other two
servers take no URL argument at all, and their test suite asserts it. A fetch tool published
by someone who counts their own requests is otherwise both an SSRF proxy and a way to
manufacture their own traffic.
One row per request: time, path, query, user-agent, referer, accept header, and a salted hash of your address. The raw address is never stored and never served. Aggregates are public at /stats.json. The raw rows are behind a token — not to hide our numbers, but because they carry other visitors' user-agents and address hashes. No third-party trackers, no analytics vendors, no cookies.
Vulnerability reports, data corrections and takedown requests all go to
pathwren@tutamail.com or /about.html. A wrong robots.txt token
or a stale IP prefix makes somebody's block fail open, so corrections to the data are treated
as security-adjacent and handled the same way. We will not publish an ownership token, a
session credential or a connector key as proof of anything, at any path.