Privacy.
What denyfirst promises for everything it publishes. Each promise says how you can check it.
- Nothing we publish reports back to us: no telemetry, no crash reports, no licence checks. A tool of ours looks for a newer release only when you ask it to, or turn that on, and then asks the public host the release is on, never us, sending nothing about you.
- How you check it. The source is public. It contains no address of ours that a program connects to; the only one it asks about releases is GitHub's, and the request carries no identifier and no version.
- You need no account with us, and we keep no list of who runs our tools.
- How you check it. There is nothing to sign up for. A release is a set of files and a signature.
- Our pages load nothing from anywhere else: no analytics, no external fonts, no CDN, no tags.
- How you check it. Your browser's network panel shows every request going only to the server you are reading.
- You can check what we publish instead of trusting it. The source is public, releases are signed, and anyone can rebuild a release to the same bytes.
- How you check it. Each product publishes its release steps with its source. A public workflow rebuilds every release and compares the hashes.
- Where we run a service, it says exactly what it keeps. A product may keep less than this list allows, never more, and may not reword these.
- How you check it. Each product lists its additions on its own page. The texts are written once in the source, and a test fails if a product rewords one of these.
- Security problems can be reported to a published address that says when it expires.
- How you check it. https://denyfirst.dev/.well-known/security.txt (RFC 9116) names the contact and the expiry date.
This site
No cookies, no analytics, and nothing loaded from other sites. It runs on the same server as Porch’s demo, rented from Hetzner Online GmbH in Germany. The server keeps no log of visits; what it does keep is on Porch’s privacy page.
Writing to us
A letter to hello@denyfirst.dev reaches our mail provider and us like any other mail, with the address and headers it was sent with. We use it to answer you and for nothing else: it goes on no list, and it is not passed on. Write from any address you like. Security reports go to the address in security.txt.
Products
Each product adds its own promises:
- Porch — Checks TLS, websites, mail and DNS, and grades what it finds.