denyfirst.

What denyfirst
never receives.

This page is about the people, not the tool. Whatever you run from here, these are the undertakings of the organisation that published it — and beside each one, how to establish it for yourself rather than take it on trust.

They are separate from any product's page on purpose. Somebody deciding whether to run a tool wants to know what it does to the machine it runs on; somebody deciding whether to trust whoever wrote it wants to know what those people get. One page answering both makes every sentence something you have to read twice to work out which question it belongs to, and the answers that matter most end up buried in the details of a single check.

The organisation

Nothing published by denyfirst reports back to denyfirst. There is no telemetry, no update check, no crash report and no licence check in any of it.
How you check it. Every connection a copy makes is to something the person running it asked about. The source is public, and there is no address belonging to this organisation in it that a program connects to.
Using what denyfirst publishes needs no account with denyfirst, and this organisation keeps no register of who runs its tools.
How you check it. There is nothing to register with. A release is a set of files and a signature; nothing is issued to a person and nothing is revoked.
Nothing denyfirst publishes carries third-party code. No dependency is fetched to build it, and no page loads anything from anywhere else — no analytics, no fonts, no content delivery network, no tag of any kind.
How you check it. go.mod carries no require block, so a build fetches nothing. A browser's network panel on any page here shows one stylesheet and at most two scripts, all from the server you are reading.
What denyfirst publishes is meant to be checked rather than believed. The source is public; a release is built on a machine that cannot sign it and signed on a machine that does not build it; and a workflow rebuilds the tag to the same bytes.
How you check it. docs/releasing.md is the procedure, and every step in it is there because it has gone wrong once. The rebuild runs in public and its output is a list of hashes anybody can compare with the files they downloaded.
Where denyfirst runs a service, that service says exactly what it keeps. A product may undertake to keep less than this list requires. It may never undertake more, and it may not restate any of these in its own words.
How you check it. Each product's page carries this list unchanged, from one place in the source, and adds its own restrictions underneath. A product that reworded one of these would fail its own tests.
A fault in anything denyfirst publishes has a published address to report it to, and that address says when it stops being current.
How you check it. /.well-known/security.txt on this site, which RFC 9116 defines, names the contact and carries an expiry date.

What each product adds

A product may undertake to keep less than the list above requires. It may never undertake more, and it may not restate one of those undertakings in its own words: an addition that redefined one would be how a weaker promise arrives wearing a stronger promise's name. What follows is narrower than the list above, never a rewording of it.

Porch

Measures how a host is reached — its TLS handshake, its web reach, its mail policy and its DNS — and grades what it finds.

An installation keeps no record of what was scanned, by whom, or when. Not the hostname, not the address that asked, not a timestamp beyond a date.
How you check it. There is no code that could write one, and a test fails if any appears. The published counter is a number with nothing behind it, which is why it can be published at all.
A scan reads what a server volunteers and sends nothing that could change anything. No authentication is attempted, no address is invented, no exploit or malformed packet is sent, and no mail is ever composed.
How you check it. The method pages list every connection a scan makes and every address it asks for, each beside the document that defines it.
A report says which of its questions went unanswered, rather than leaving silence to read as a pass.
How you check it. Every row is drawn whether or not there was an answer, and each says which kind of nothing it found.
An installation refuses private, loopback, link-local and reserved destinations, including ones reached by following a redirect a scanned server chose.
How you check it. internal/safedial decides it where the connection is made, so an added entry point cannot walk around it.

What this page does not cover

What a particular check sends, what an installation of it holds, and what a report carries are questions for that product's own pages, because the answers differ between them and a sentence true of one would be a guarantee falsely extended to the other. Porch answers them on its privacy page and on the pages describing each method.

Nor does it cover the network. Any service is carried by a provider who can see that connections are made, and runs on hardware somebody else owns; that is true of every tool anywhere and no undertaking here can remove it. What this organisation can do is add nothing to it, which is what the first undertaking above is about.