denyfirst.

Independent security and privacy tools

Security.
On your terms.

Tools you can read, rebuild and check for yourself.

  1. deny cookies no Set-Cookie, ever
  2. deny trackers none in the page
  3. deny other servers CSP default-src 'none'
  4. deny fingerprinting no canvas, no font probing
  5. deny accounts, telemetry nothing to sign up for
  6. allow what you can check all our code is public
Deny first, then allow only what is needed. What this visit took

01 / Products

What we make.

Available

porch.

Checks what your servers show the outside world. Runs on your own server, and keeps your data with you.

Try it on our domain
  • TLS and certificates
  • Website: HTTPS, HSTS, headers
  • Mail: SPF, DKIM, DMARC, MTA-STS
  • DNS: name servers and DNSSEC
  • Names under your domain

Coming

Rootwell

A self-hosted workspace for certificates and keys. Rootwell is not available yet, and no date is promised.

02 / How we work

Three rules.

Every tool we make keeps them, and you can check each one.

  1. Evidence first.

    A result shows what was seen and the standard behind it. Never a verdict without a source.

    How you check it Our code is public, and every rule in it names the standard it applies.

  2. Your data stays with you.

    Our tools run on your machine. We collect nothing.

    How you check it Open your browser’s network panel: these pages load nothing from anyone else.

  3. A clear scope.

    We read only what is already shown. No exploits, no guessing, no logins.

    How you check it Every tool we make publishes each connection it opens. Porch’s list.

03 / Releases

No one of us can ship alone.

Two parties make every release, and neither can do it without the other. Then a third checks both. The last line is yours.

Every release

  1. Tag signedMaintainer git tag -s
  2. Built in publicA workflow build-release.yml, which cannot sign
  3. Rebuilt, every byte matched, signedMaintainer release.ps1 -Compare, SHA256SUMS.sig
  4. Rebuilt again, after publishingAnother workflow reproduce.yml
  5. Checked by youYou Your turn: verify a release

04 / The team

Small and independent.

denyfirst is an independent team that puts privacy first. You know us by our work, and by the key that signs every release.

Source on GitHub

05 / This visit

Your receipt.

Every site takes something when you open it. This is everything this one took.

Open your browser’s network panel and check each line yourself.

denyfirst.

Receipt · this visit

Cookies set
0
Trackers
0
Other servers asked
0
Files loaded
6
Kept in your cache
0
Told to the next site
nothing
Recorded about you
nothing
Total collected
0

No copy of this receipt was kept.

Most sites end by asking for your email.

We don’t need your email, your name, or anything else about you.

Here’s ours instead.

hello@denyfirst.devWrite to us

Write from any address you like. No account, no form.