About this check
A tool that makes requests to other people's websites should be able to say exactly what it asks for and exactly what it refuses to do. This page is that.
Exactly what happens
Three requests, a few hundred bytes each.
When you submit an address, the check makes three ordinary unauthenticated requests over HTTPS to that hostname:
| Path | What it answers |
|---|---|
/.git/HEAD | Whether a repository is being served at all. This is the one the verdict rests on. |
/.git/config | Whether the configuration file is also readable, which is worth reporting separately because that file sometimes contains an access token. |
/.git/ | Whether the directory lists its own contents, which removes even the need to guess at filenames. |
Each request carries a user agent naming this site so that anyone reading their own logs can see who asked and why. Redirects are not followed. Each response is read to a maximum of 320 bytes and then abandoned, which is enough to tell a git file from a web page and nowhere near enough to be a copy of anything.
Those bytes are used to decide the verdict and are then discarded. They are never shown to you, never written down and never sent anywhere.
The refusals
What it will not do, on purpose.
- It will not download your repository. It never requests an object, a pack file or an index, and it never reconstructs a source file. Proving the point by taking a copy of somebody's code is the thing being warned about, not a demonstration of it.
- It will not show you what it read. Not from your site and not from anybody else's. The verdict is a handful of yes and no answers.
- It will not accept a numeric address. Websites are checked by name. A tool that accepts addresses can be pointed at machines that were never meant to be reachable from outside, and there is no version of that which is this tool's business.
- It will not follow a redirect. A redirect points somewhere nobody asked it to look.
- It will not accept a port or a scheme from you. The address you type is reduced to a hostname, and the request is then built here as HTTPS on the standard port.
- It will not run at scale. Checks are limited per visitor, because the tool exists for somebody looking at their own sites and not for sweeping a list of other people's.
The obvious question
Does a check like this need permission?
No, and the reason is worth stating rather than assuming.
Everything here is a request for a file that your web server hands to anybody who asks. It is the same request a browser makes, answered the same way. Nothing is bypassed, guessed at or attacked. If the answer comes back, it is because the site is publishing it.
Testing a website is a different thing. Sending input designed to make an application misbehave, trying credentials, or reaching for data meant for somebody else all need the owner's permission in writing, and anybody offering to do those things without asking is telling you something about how they work.
That line is why this check is free and instant, and why the paid test is neither.
What this site does not do
No cookies, no code, no third party.
This site sets no cookie and uses nothing in local or session storage. There is no analytics beacon, no font from somebody else's server, no captcha and no embedded anything. No code runs on any page, which is why the check is a form that reloads the page rather than something that updates in place.
Every page carries a content security policy, so the claim is enforced by the browser rather than resting on anybody's word for it. A site whose subject is what a website gives away ought to be the easiest one you visit all week to audit.
One exact carve out, and it is worth describing rather than glossing. Each guide carries a single block of structured data, which is a list of its own questions and answers written so a search engine can read them. It is data rather than code and no browser executes it. It is still technically a script element, so the policy names it by a fingerprint of its exact contents. Nothing else is permitted: not an inline script, not a file, not an event handler, not one loaded from somewhere else. Change one character of that block and the browser refuses it.
Who runs it
Dalaric, and one person.
git.guide is run by Dalaric Limited, a one person consultancy in Dorset. Hosting, domains, email and databases since 1996. Websites are the small part.
The person who would read your report is the person who runs the mail and the DNS for other people's businesses. That is the whole credential, and it is why a check like this comes with an explanation rather than a list.
The check is free and stays free. It sells nothing and needs no account. It is how a good many people meet us, and charging for it would break the thing it is for.
What is paid is the work that needs a person: an authorised test of a whole web application, or the infrastructure work behind a site that is deployed in a way nobody would design on purpose.
Getting hold of us
One address, and it reaches a person.
info@dalaric.com reaches the person who wrote the guides and the checker. An enquiry gets an answer within one working day.
There is no form, and that is deliberate rather than lazy. A form here would mean a captcha or a page that runs something, and this is the site that spends nine pages on what a website loads without telling you. An address needs neither, and it means nothing about you is collected by this site at all.
If you have found a problem with this check itself, or a case it reads wrongly, that is genuinely welcome. Please say which address you checked.