Blame Web — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Blame Web (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The blame.today web client — the "raw firehose." A client-side Svelte + Vite app that talks straight to nostr relays: the vote path has no backend, no auth, no rate limit (events go direct to relays). A thin Cloudflare Worker fronts the static site to force https, redirect www -> apex, and serve the MCP pointer at /mcp. This is the open, canonical realization of blame; the iOS app lives in the sibling blame-ios repo.
Split out of blame-today/blame-mobile (the old iOS app + worker repo) so each surface is honestly its own thing — they share a brand and the pureblameapp nostr tag, but no code, build, or deploy.
kind 1 event tagged pureblameapp; a vote is a kind 7 reaction tagged e:<targetId> + pureblameapp. throwaway key per event.COUNTs (all-time + a 24h "hot" window), not by fetching events.compromise) into clickable suggestions.npm install
npm run dev # vite dev server
npm test # vitest unit tests
npm run test:e2e # playwright
npm run build # -> dist/Push to main → .github/workflows/deploy-web.yml builds dist/ and runs wrangler deploy, publishing to the Cloudflare Worker (blame-today, Workers + Static Assets) that serves blame.today. The worker (worker/index.js) serves dist/ as static assets, force-upgrades http → https, redirects www → apex, and serves the MCP inline at /mcp (worker/mcp.js). Needs CLOUDFLARE_API_TOKEN (Workers:Edit) + CLOUDFLARE_ACCOUNT_ID repo secrets. The /about prose lives in public/about/ and Vite copies it into dist/about/.
Migrated off GitHub Pages 2026-06-16 — the zone is on Cloudflare now and blame.today is a custom domain on the worker. A push touching only scripts/** or infra/** skips the rebuild.
The CF "clicky layer" — DNS records, zone settings (HSTS, Always Use HTTPS), the www → apex redirect rule, and email routing (*@blame.today → gmail) — is declarative IaC in infra/ (OpenTofu). wrangler owns the worker code + the apex custom domain; OpenTofu owns everything else, each resource with exactly one owner. See infra/README.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.