Hash the code your browser is running.

The check above downloads each JavaScript and CSS file your browser executes, hashes it with the WebCrypto API, and compares the result to build-manifest.json — the manifest generated at build time. If a file were altered in transit, by a CDN, or by anything between our server and you, its hash would change and the row would read MISMATCH.

Be clear-eyed about the limit: the manifest is served by the same origin as the code. An operator who wanted to ship you malicious JavaScript could publish a manifest matching it, and this page would show green. Comparing a file against a description of itself is not proof of anything on its own.

That is why the same manifest is committed to the public repository. GitHub is a separate trust domain — we cannot alter what is already published there without it being visible. Compare the two, and the claim becomes checkable by someone other than us.

This is bundle transparency, not a reproducible build. Our build output is not yet guaranteed byte-identical across machines, so cloning the repo and running bun run build can legitimately produce different hashes. We would rather say that plainly than let a green checkmark imply more than it earns. Making the build deterministic is the next step, and until it lands, treat this page as evidence about delivery — not about provenance.