Opening the archive

This is the first record in the archive, and for now it is the only one. It exists to state, once, what this site is for and what it will and will not publish — so every later entry can just be the work.

What gets published

Three kinds of record, and nothing else:

• Notes track progress, small findings and things worth remembering. They are dated to the month, because the exact day of a note is noise.
• Releases point at finished, signed software. Only releases carry an exact date, because a signed artefact has a real publication moment worth citing.
• Guides are canonical documentation. When a repository needs setup instructions, they will live here and the repository will link back, so there is one copy to keep correct instead of two to keep in sync.

Nothing has been filed under releases or guides yet. When something is finished, it will appear here and not before.

What never gets published

The archive is deliberately narrow. No addresses, hostnames, account names, institutions or locations. No credentials, tokens or keys, not even expired ones. No image metadata: every picture is stripped and re-encoded before it is committed.

Vulnerability research appears here only after coordinated disclosure has run its course and publication is explicitly permitted. If something is missing, assume it is either unfinished or not mine to publish yet.

How the site behaves

Every page is static HTML built ahead of time. There are no cookies, no analytics, no third-party scripts, no embeds and no external font requests — the fonts ship with the site. Nothing here calls out to anyone while you read.

JavaScript adds three things: the theme switch, the archive filter, and a short boot sequence on the home page. Turn it off and every word is still here.

The point of an archive is not to look busy. It is to still be readable in five years, by someone who was not there.