Trust

Everything claimed below can be checked from outside, right now, without an account:

curl -s https://www.pathwren.workers.dev/stats.json      # who actually visits — external clients only, ours excluded
curl -s https://www.pathwren.workers.dev/status.json     # when each mirrored upstream last answered, and which failed
curl -s https://www.pathwren.workers.dev/documents.json  # every document, its sha-256 and when its bytes last changed

What this host does not have

Stated first, because a trust page that buries it is not one. There is no SOC 2 report, no ISO 27001 certificate, no penetration test report, no external audit of any kind, no SLA, no uptime commitment, no support contract, no insurance, no data processing agreement on offer and no company to sign one. Nothing on this host is certified by anybody, and no such claim will appear here. If your process requires one of those documents, this project cannot supply it, and that is the end of the answer rather than the start of a negotiation. /compliance lists the usual asks one by one, and what exists in place of each.

What it does have

• Provenance on every mirrored file. Each IP-range mirror keeps the upstream URL, the operator's own timestamp, our fetch time and a SHA-256 of the bytes we received. A source that fails keeps its last known prefixes and is marked failed on /status.html, because a prefix list that silently shrinks is worse than one that is visibly stale.
• Published validators. /documents.json gives a strong ETag and a Last-Modified for every machine document, so you can tell what changed without fetching it, and /changes.json answers the same question from a cursor.
• Public numbers. Our own traffic counts are public and exclude our own requests: /stats.json.
• No moving parts. A Cloudflare Worker in front of static files. No origin server, no application runtime, no database in a request path, no accounts, no cookies, no sessions, no forms, no uploads — so there is no credential of yours here to lose. The full posture, including which probe paths are 404 on purpose, is at /security.
• Everything is CC0. If this project disappears tomorrow, the data is already yours: one file, /data/agents.json, no attribution required.

Where this host is degraded right now

The live counter is the one thing here that can be unavailable, and it is unavailable more often than we would like: the free-tier database behind it has a daily read allowance, and when that is spent /stats.json answers 503 with "counts temporarily unavailable" and the #live block on every page says the same in words. It never prints a zero and never prints a stale number instead. Documents are unaffected — they are static files and keep being served — and the counter returns on its own at the next UTC day. If the first curl above gives you a 503, that is this, and it is the honest failure mode rather than a broken one.

Who else touches a request

Cloudflare, and nobody else: it hosts the worker, the static files and the database the request log is written to. There are no analytics vendors, no advertising networks, no tag managers, no third-party scripts and no data sold or shared — /privacy.json lists all three of those as empty arrays and is regenerated on every rebuild.

What is recorded about you

One row per request, written at the edge before anything is served: time, path, query, user-agent, referer, accept header, status, bytes, and a salted SHA-256 hash of your address, truncated. The raw address is never stored and never served. There is no automatic deletion configured today, and /privacy.html says so in those words rather than implying a retention policy that does not exist.

Availability, honestly

Free-tier hosting, roughly 100,000 requests a day shared by everything at this address, no rate limit configured, best effort, no guarantee. If availability is ever threatened a rate limit will be added and named in /terms.json rather than applied silently.

If something is wrong

Vulnerability reports, data corrections and takedown requests go to pathwren@tutamail.com or through /.well-known/security.txt. Corrections to the data are treated as security-adjacent, because a wrong token or a stale prefix makes somebody's block fail open.

Asked for by Mozilla/5.0 (compatible; apievangelist-security-probe/1.0) at 2026-09-01T11:59:36Z, alongside /security and /compliance, and by spanly-enrich/1.0 (+https://spanly.com) earlier the same day.