Privacy

The short version

There are no accounts, no advertising, no tracking scripts, and nothing that follows you from one site to the next. You can read every page here without telling us who you are.

What does exist is the web server's ordinary access log. We read traffic figures out of it — which pages get reached, what links here, what breaks — and that is the whole of our analytics. Nothing runs in your browser to measure you. The section below says what happens to it after that.

What the server records

The web server keeps ordinary access logs: the IP address of the request, the URL requested, the time, the response code, the page that linked you here, and the browser's user-agent string. They are used to keep the site up, to spot abuse, and to see which pages people actually reach.

A URL includes its query string, so a search you run here is written to that log beside the address that ran it. Nothing links those entries to a person and we make no attempt to; but if you would rather a particular search not be recorded anywhere, that is the honest answer.

The application writes its own line for every page it serves — the URL, the response code, how long it took, and how many database queries it ran. Those entries exist to find slow pages, and they record no address.

To stop one busy client overwhelming a small server, recent requests are counted per IP address in memory. Those counters expire within a couple of minutes and are never written to the database.

A web application firewall sits in front of the site and checks each request against a public ruleset. It writes an entry when a rule objects to a request — whether or not the request is then refused — and when the site answers with an error other than a plain “page not found”. A request that no rule objects to and that the site answers normally leaves nothing in that firewall log. Those entries record the time, the address the request came from, the request line and its headers, which rule objected, and the fragment of the request that set it off. Whole request and response bodies are deliberately excluded.

The web server also keeps its own error log. When a request fails, or a connection to the site is refused or malformed, it records the time, the address it came from, and the request if there was one, including the page that linked you here.

Who else handles the logs

The site runs on rented infrastructure, so the company hosting it necessarily carries the traffic that reaches us.

Beyond that, log storage and searching happen in a hosted service — the ordinary kind of tool an engineer uses to search logs and watch error rates. The access log, the firewall log, and the server's own error log described above, IP addresses included, are held and queried there as well as on our own server.

A provider like that works on our behalf and under contract. It may not use what it stores for its own purposes, may not sell it, and may not combine it with data from anywhere else. That is a different arrangement from an analytics company, which is paid in the data itself — and it is the reason none of this involves your browser contacting anyone.

Cookies and local storage

This site sets no cookies for readers. There is no sign-in, and nothing here needs to recognise your browser from one request to the next.

Two things are kept in your browser's local storage. Neither is a cookie, neither is ever sent to us, and both are yours to clear:

• Your light, dark, or system theme choice, so the next page does not flash the wrong one.
• A short cache of pages you have already loaded from this site, so pressing Back restores the results you were looking at instead of fetching them again.

Clearing this site's data in your browser removes both.

Third parties your browser contacts

None. Every asset a page needs — fonts, stylesheets, scripts, images — is served from this domain. Loading a page here does not cause your browser to contact any other company, so no third party learns your IP address or which pages you read.

This is deliberate. The typefaces and the one JavaScript library the site uses are both open source, and we keep our own copies rather than pulling them from a CDN.

Links out to source repositories, MITRE ATT&CK, and vendor documentation are ordinary links. Following one takes you to a site with its own privacy practices, which are not ours.

What we do not do

• No analytics scripts, measurement pixels, or tags — nothing loads in your browser to count you.
• No analytics company, and nothing paid for in data. Where a provider handles our logs it does so on our instructions and for no purpose of its own.
• No advertising, and no sale or sharing of anything with data brokers.
• No profiling, fingerprinting, or cross-site tracking.

When this changes

Community notes will eventually require accounts, and accounts require storing an identity. When that happens this page will be rewritten before the feature ships, not after.

Contact

Questions about any of the above, or a request to have something removed, can be sent to contact@detections.org.