Self-hosted means self-contained.

The promise

No update checks, crash reports, analytics, outside fonts or outside scripts. What you install is everything it needs.

What is implemented

• This website: every font, script and style is served from this domain. The Content-Security-Policy header forbids connections anywhere else (connect-src 'none'). A build-time check fails if any page references another origin for a resource.

What is planned

• The same rule for the edge web app: default-src 'self', assets bundled, no CDN.
• A dependency audit that lists every package capable of opening a socket and compares it with an approved list.

How to check it yourself

• On this site: open the browser developer tools, Network tab, reload. Every request is to this host.
• Read the response headers for the Content-Security-Policy.

Found a gap between this page and the software? Tell us. A promise we cannot keep gets rewritten, not defended.

All promises