The trust model, plainly
- The source is public. Production is built and deployed by Cloudflare Workers Builds from the repository’s
main branch — Cloudflare is the trusted hosting and
build party. - The site itself ships no server code — a fixed set of static files;
everything it can do is in the JavaScript you can read and verify. The one server piece
is the backdrop painter’s tiny relay at
/api/background (public in the
repository, same origin), which receives only the scene description you type into the
▒ box — if you never use it, nothing is ever sent. - A Content-Security-Policy — enforced by your browser, not by this site — blocks
requests to any other origin. Your draft lives in this browser’s local storage and is
never transmitted.
- Builds are reproducible: building the commit above yields byte-for-byte the files this
site serves. That check is the only part that requires trusting no one — you can run it
yourself.
Verify it yourself
git clone https://github.com/padolsey/onesown
cd onesown && git checkout 59a1600
corepack enable && pnpm install --frozen-lockfile
pnpm build
node scripts/verify-deployment.mjs https://onesown.app
The script hashes every file your build produced and compares it against the bytes this
site serves. Full procedure and trust notes: DEPLOYMENT_VERIFICATION.md.
What this does not prove
- Verification is per-version: it proves the deployment you checked, at
the time you checked it. A future deploy could behave differently — the commit history
is append-only precisely so past claims stay auditable.
- “Production deploys only through Cloudflare Builds” is operating policy, not a
technical guarantee — the account owner could deploy manually. The reproducibility
check is how you’d notice.
- Cloudflare (serving, TLS, the build pipeline) and your own browser and extensions are
outside what this page can attest to.
- No web page can honestly claim it is mathematically incapable of tracking you.
This one claims something narrower and checkable: the code being served is the public
code, the only request it can make is the opt-in backdrop prompt to its own origin,
and your browser is instructed to refuse any other.
← Back to the room