Orivon Attila V0.0.1

Aave

version release-2026-10-05_04-19 · evaluated 2026-10-05

Level 2 of 4Supports DDOC

Aave's official IPFS release of its app, open source. It is not Level 3: when it opens it loads dozens of scripts from app.family.co, Cloudflare's insights beacon and challenge scripts, and sends data to Sentry and Datadog. Markets and balances come from Aave's API and a Tenderly RPC endpoint.

• cid:bafybeig2qwvk3zseuwbnm76hs66nzgueb74eqvnc5fnx5lbtzco6m3fl44

Evidence

• https://github.com/aave/interface
• https://github.com/aave/interface/releases/tag/release-2026-10-05_04-19

Aerodrome

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Aerodrome's trading app on Base. No public source was found for the frontend (the project publishes contracts, SDKs and docs), so it stays at Level 2. When it opens it reads chain data from Alchemy and dRPC endpoints and contacts WalletConnect's servers.

• cid:bafybeihlcmsi6l4i7g5brdr2wet4j6wic77mnmoldgnk3p3pt5g2lugrii

Evidence

• https://github.com/aerodrome-finance

AirGap Vault

version 3.34.4 · evaluated 2026-10-05

Level 4 of 4+ privacyTrustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless; privacy: every activity, including connections and operations, is privacy preserving; no connection shows the user to another party, even with consent

An offline signer, built from upstream's open source at a pinned commit. It runs only its own bundled code and makes no network request: every file it loads comes from its own tree. In Orivon it creates and shows accounts but cannot sign, because QR scanning and clipboard reading are refused to every site. It is designed for a phone kept offline; this computer is not.

• sha256:d14cc7e8255993af3c0e9e103b9fb7ece94e60dca47f3215621d125ff8964b72
• cid:bafybeifswtpznor64py5vd5gm5gu26auju4gc23dqxt4waxlyigtgcbweu
• sha256:c42dcbe06faf241d2606130d150c4345dfff348729d67947b406b3c6c48f1e53
• cid:bafybeicqymfv47eg7aphl3luwen3tpdosb622m7kwsnt4rkfacagnpbymu

Evidence

• https://github.com/airgap-it/airgap-vault
• https://github.com/OrivonBrowser/orivon-ports/tree/main/apps/airgap-vault

AirSwap

evaluated 2026-10-05

Level 2 of 4Supports DDOC

AirSwap's web app, open source (MIT). It is not Level 3: when it opens it loads Google Tag Manager and Google Analytics, and fonts from Adobe Typekit. Trades settle on chain, but the app reads through hosted endpoints and makers' own servers.

• cid:bafybeib35za7f5wgavowqj5upcfsuvurfso3gkoddrvmx5obxwi4dbltvy

Evidence

• https://github.com/airswap/airswap-web

Alcove

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Alcove, an RSS reader, open source (MIT). It runs no third-party code, which is Level 3. It is not Level 4: when it opens it connects to its author's sync relays (relay.alcove.tools), and feeds are fetched through its author's proxies (proxy.alcove.tools), which see what you read.

• cid:bafybeiae5xzocfz6zabhnozqiagexvcfj3qljcwgrzgnblzm3sfsmdmepu

Evidence

• https://github.com/stevedylandev/alcove

API3 DAO

evaluated 2026-10-05

Level 2 of 4Supports DDOC

The API3 DAO staking and voting dashboard. Its source is public (no licence file). It is not Level 3: when it opens, its wallet library loads WalletConnect's hidden verify frame, third-party code the user has not asked for. It also embeds a YouTube video and loads Google Fonts.

• cid:bafybeibzhmtxvo2bmi4e4apjuueb5ri7g5f2xn3wiyfrhjdm6vrpdksw4u

Evidence

• https://github.com/api3dao/api3-dao-dashboard

ASGARDEX

version 1.45.3 · evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

A THORChain and MAYAChain wallet and exchange. Its code is open source and every script it runs ships in its own bundle, which is Level 3. It is not Level 4: balances, quotes and vault addresses come from centralised APIs that are not checked against any chain.

• sha256:26054c511f3394b66c6a022a48d82e559d637ac4b111657482ec6b7a7447fbcf
• cid:bafybeiek2i5n7n7ksldz6lc56jeku5fwsttj6jv7l527dhrlxwdnw4lpty
• sha256:40cfd32f0f42cbdcd27c490ebf359101cd9e266657c3c8db04c736be3bb3ad64
• cid:bafybeiapptln3qdfg2ubwh7lxj6zgxc3s3fc4qb7k3wucfcq7tbqdp7h3u

Evidence

• https://github.com/asgardex/asgardex-desktop
• https://dev.thorchain.org
• https://github.com/OrivonBrowser/orivon-ports/tree/main/apps/asgardex

Austin Vernon's blog

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Austin Vernon's blog: plain HTML served as written, so its source is public, and it runs no script, which is Level 3. It is not Level 4: when it opens it loads images from Imgur.

• cid:bafybeiddzfrkx5z7jifevmkbivd65kjm36l5g3zgn5qc23munkq3z7wxoe

Evidence

• https://austinvernon.eth.limo/

Banny's Network

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Banny's Network, a page built with Planet's Croptop template, whose source is public (no licence file). It runs no third-party code, which is Level 3. It is not Level 4: when it opens it asks pinnable.xyz for the peers of its IPNS name.

• cid:bafybeifay6gaxeha3fv2xpdjzlsbtkigu6xvio6koehi6hklabiel66aka

Evidence

• https://github.com/Planetable/SiteTemplateCroptop

CoW Swap

evaluated 2026-10-05

Level 2 of 4Supports DDOC

CoW Swap's trading app, open source (GPL-3.0). It is not Level 3: when it opens it loads third-party code nobody is told about: Google Tag Manager, Microsoft Clarity session replay, Reddit, X and Adform ad pixels, Sentry error reporting and LaunchDarkly feature flags. Quotes, orders and balances come from CoW Protocol's own servers and an Infura endpoint.

• cid:bafybeib77kqm53u6qpfczltq56iqbswwtgxqi435e4redd3cdgydkvtbui

Evidence

• https://github.com/cowprotocol/cowswap

Croptop

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Croptop's site, a page built with Planet's Croptop template, whose source is public (no licence file). It is not Level 3: when it opens it loads Plausible's analytics script. It also reads from juicebox.center.

• cid:bafybeie3wqowzwcarfol7sfo27rbwi5ygstz2ucgbq7f6esgawnzumr7ru

Evidence

• https://github.com/Planetable/SiteTemplateCroptop

Dapp Rank

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Dapp Rank, which rates dapps on censorship resistance, open source (GPL-3.0). It runs no third-party code, which is Level 3. It is not Level 4: when it opens, its own code reports the visit to Plausible.

• cid:bafybeicjwmvde4qnqkhewrxfabryushxwzfgy5uy4a2ur36cvopfw7rl2m

Evidence

• https://github.com/stigmergic-org/dapprank

Devcon

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Devcon's link page at devcon.eth, open source (GPL-3.0). It runs no third-party code, which is Level 3. It is not Level 4: when it opens it reads links from devcon.org's API, images from Supabase and records from a public RPC endpoint.

• cid:bafybeibj3porjg5eat6qayz7sn25a6rzfaqb3umg45sqlzpppshyrm22nq

Evidence

• https://github.com/efdevcon/monorepo

DXdao

evaluated 2026-10-05

Level 2 of 4Supports DDOC

DXdao's website and contributor hub. No public source was found for this site (a Gatsby build; DXdao's public repositories hold its other products), so it stays at Level 2. When it opens it reads figures from DefiLlama's API.

• cid:bafybeidqll2xrx2o6e5zzvlifxvzpy7aopqjxojiccgvtpnl5frxalphvy

Ethereum File System

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

The Ethereum File System app, open source (MIT). It runs no third-party code, which is Level 3. It is not Level 4: when it opens it reads chain data from Alchemy and dRPC endpoints, sends WalletConnect telemetry and loads Google Fonts.

• cid:bafybeiehnviixu674bvbazajj27x2kffn7gswn2rfms62juaa6ijywu6pm

Evidence

• https://github.com/efs-project/contracts

Element

version 1.12.29 · evaluated 2026-10-05

Level 4 of 4Trustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless

A Matrix chat client, built from upstream's open source at a pinned commit. Third-party code (widgets, the integration manager, calls) loads only in frames the person opens or accepts. The homeserver the user signs in to holds the account and delivers every message, which a user clearly knows; encryption keys stay on this computer, and the other services are used only on the user's action or consent. That is Level 4 under the exception for evident trust. Not private: servers see who talks to whom and when.

• sha256:a42796bc8b56a0b3e06d2e76d1e2aac76e99e8e09d5b65d2045f7bec508bae57
• cid:bafybeifbqmphucl4qe3vpuhnwlyk2pusmdnv5vjs4xumvmshdttrdg2p64
• sha256:c3c7f8f8227a5b6127e6622864ec9d6c0bc4180c87032e0df4b897f0cf961247
• cid:bafybeiejev3mbko3dqbjoihrvctufjikokb6ql5zobt47ok5vtjcyh3ig4

Evidence

• https://github.com/element-hq/element-web
• https://spec.matrix.org
• https://github.com/OrivonBrowser/orivon-ports/tree/main/apps/element

ENS documentation

evaluated 2026-10-05

Level 2 of 4Supports DDOC

The ENS documentation, open source (CC0). It is not Level 3: when it opens it loads a documentation chatbot script from jsDelivr (@cookbookdev/docsbot) with no integrity hash, third-party code the user has not asked for. It also fetches the Solidity compiler list and loads Google Fonts.

• cid:bafybeibmcu52uovuzmmy3yugwcc77jkbbdl7q5yrq2a4yupmefjpnq2rva

Evidence

• https://github.com/ensdomains/docs

ENS

evaluated 2026-10-05

Level 2 of 4Supports DDOC

The ENS manager app, open source (MIT). It is not Level 3: when it opens it loads Plausible's analytics script, Intercom's chat widget and WalletConnect's hidden verify frame. Names are read from the ENS subgraph and RPC endpoints.

• cid:bafybeiho37vhh7qnzrs2drjuasagbebojgbx7467ag5aktifdhhz7smc2q

Evidence

• https://github.com/ensdomains/ens-app-v3

ENS Interviews

evaluated 2026-10-05

Level 4 of 4+ privacyTrustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless; privacy: every activity, including connections and operations, is privacy preserving; no connection shows the user to another party, even with consent

ENS Interviews, a static site built with Spheron's site builder. It serves its scripts with their source maps, so their source is readable in what it serves, and it loads only its own files, so it makes no request beyond the site itself.

• cid:bafybeid5mst6zvo7gya4pt24iq2q2w75ad3pyr4rlsrcg4jj5ug4elxvhu

Evidence

• https://ensinterviews.eth.limo/

Eternal Safe

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Eternal Safe, a decentralised fork of the Safe{Wallet} interface, open source (GPL-3.0). It makes no request when it opens and runs no third-party code, which is Level 3. It is not Level 4: once a network is chosen, Safe accounts are read through public RPC endpoints (Infura, Ankr and others) by default, without a light client. A custom endpoint can be set.

• cid:bafybeie35n6rokcysg6e7vfwhebxgrbrdmnnla4qjvqby7vn3yups3ldqa

Evidence

• https://github.com/eternalsafe/wallet

Ethereum Phunks Market

evaluated 2026-10-05

Level 2 of 4Supports DDOC

The Ethereum Phunks marketplace, open source (CC0). It is not Level 3: when it opens it loads Plausible's analytics script. Listings come from the team's relay, a Supabase database and other indexers, and chain data from Alchemy.

• cid:bafybeid5uzcdmkohd3m332xs6sxrc3tykeglkoxtesn4k4y7zcdmas7wgi

Evidence

• https://github.com/Ethereum-Phunks/ethereumphunks.com

EthHub

evaluated 2026-10-05

Level 2 of 4Supports DDOC

An old build of EthHub's community documentation, whose content is public (CC BY-SA 4.0). It is not Level 3: when it opens it loads Google Tag Manager and Google Analytics.

• cid:bafybeibiksiuod2y2hjuywoobfojmkddfhyzqrw4fgilha2nxnyzzisliq

Evidence

• https://github.com/ethhub-io/ethhub

ETHMumbai

evaluated 2026-10-05

Level 2 of 4Supports DDOC

ETHMumbai's page for its March 2026 event. No public source matches this build, so it stays at Level 2. When it opens it loads Google Fonts and calls www.ethmumbai.in.

• cid:bafybeieylhlp2msd7q2xs2kl5q4wal5ymkr6lyjonnogexuvhbx43huram

Orivon Explore

version 0.1.0 · evaluated 2026-10-05

Level 4 of 4Trustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless

Orivon's directory of Web3 sites, open source, and judged here by its own publisher. The page sends no request itself: the directory and a dated snapshot of judgements ship inside it. It is not private: a visitor who grants trust.score has Orivon resolve every listed .eth name and ask their Web3 Score provider about every listed site, which shows the provider their IP address and that they opened Explore. Which sites it lists is the publisher's choice, fixed in each build.

• sha256:b87f63d55f463c6edd4969d9b51548b084f3763fca2782cf880c29e6993c852c
• cid:bafybeicivdtc5jypu56et2eptp2urmlck3m5bcchowetw36fwytn4mnzzu
• sha256:26636fb15f9b823f6748fca456da57a116c904f7ab5cd6a8895366e1c8c6bf1b
• cid:bafybeibn3pmlb7zpgfq3ijeiwgulnty26iogkntwzuajubewpgm2va2734
• sha256:427b9379e58e54e86e8874f0f88ba99eaf1f17aff54747ab1e7ec4a16aedda64
• cid:bafybeic2eb6job6w4nfjtmftk336ur64tdevgzoz5cn6a5ub2plxpiempu
• sha256:c54bb87316804313c814e4d4efec1ba8dff36a92d58fae391809a471d9462e63
• cid:bafybeiblwwwgoe36uehfwp3z53qotkhepdld4qi2hibkod6p5ygmnfykfm

Evidence

• https://github.com/OrivonBrowser/orivon-ports/tree/main/apps/explore

Fileverse Walkaway

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Fileverse Walkaway, which recovers dDocs and dSheets when Fileverse's own apps are offline, open source (AGPL-3.0). It makes no request when it opens and runs no third-party code, which is Level 3. It is not Level 4: recovering documents reads the chain through public RPC endpoints (Gnosis Chain, Alchemy) and files through IPFS gateways.

• cid:bafybeihad3i5ia6l7rkjiucrlde2jakpluujhwd2n366ppy723uzun6qne

Evidence

• https://github.com/fileverse/walk-away

FOCIL

evaluated 2026-10-05

Level 2 of 4Supports DDOC

An explainer for FOCIL (fork-choice enforced inclusion lists), open source (MIT). It is not Level 3: when it opens it loads MathJax from jsDelivr with no integrity hash and a floating version, code the CDN can change at any time. Its Bootstrap and Popper scripts are pinned by integrity hashes, which is fine.

• cid:bafybeih3vnjutnueboxrq5qvgfzmiu6uczbglgbhurhwdyt5tzuxwkcblm

Evidence

• https://github.com/jihoonsong/meet-focil

FreeTube

version 0.25.3 · evaluated 2026-10-05

Level 4 of 4Trustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless

A YouTube client without ads or an account, built from upstream's open source at a pinned commit. To play a video it runs YouTube's own code: the player's signature functions in a sandboxed frame, and Google's BotGuard in a youtube.com context. The user knows this from Orivon's grant dialog, and using YouTube is why they open the app. Videos and comments come from YouTube or an Invidious instance, which a user clearly knows are run by someone; subscriptions and history stay on this computer. Level 4 under the exception for evident trust. Not private: YouTube sees what you watch.

• sha256:1a5c364ac84a157a3059ad31fec6cb862afd9db79b2e03c770a9da008bc6979b
• cid:bafybeigcdsumr4jo4j6gxqbg33sd2e3kylnbxqrmepub7iwp3fwjftgoue
• sha256:ea1b1efc01afefd73f654521e1fb4d5ce77471d9c5f2c72f24a5df9a84e2e40a
• cid:bafybeihy4h5vkixrhepxqsizvoh4nuyopc2j7ypp7rk4zkxr23lvdilnzq

Evidence

• https://github.com/FreeTubeApp/FreeTube
• https://github.com/OrivonBrowser/orivon-ports/tree/main/apps/freetube

Gnosis VPN documentation

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

The Gnosis VPN documentation. Its source is public (no licence file) and it runs no third-party code, which is Level 3. It is not Level 4: when it opens it loads an icon font from jsDelivr.

• cid:bafybeih5gihptqlszwq2mdfuih3mllbwhu4a3gsvp57ywtmiexbjlemsvy

Evidence

• https://github.com/gnosis/gnosis_vpn-docs

Greg Skriloff

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Greg Skriloff's profile card: one hand-written page served as written, so its source is public, and it runs no third-party code, which is Level 3. It is not Level 4: when it opens it loads the profile picture from GitHub's avatar server.

• cid:bafybeihqxu6v2zzmmgl5gqlzpozu2ss6gh53idcdp7vnq5lccnjcxf3o3e

Evidence

• https://gregskril.eth.limo/

Hop

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Hop's bridge app, open source (MIT). It is not Level 3: when it opens it loads Google Tag Manager and Google Analytics. Chain state comes from public RPC endpoints (Ankr, 1RPC) and bridge data from Hop's subgraph, unchecked. hop.eth points to a DNSLink record on app.hop.exchange, so what the name serves follows whoever controls that domain's DNS.

• cid:bafybeifkpmerpae2nxb7gfhceyg722rdtyjybmb3fi3ucc75uxqwaxbtga

Evidence

• https://github.com/hop-protocol/hop

Immutable Frontends

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Immutable Frontends, a registry of verified decentralised frontends. Its source is public (no licence file). It is not Level 3: when it opens it loads a script from cdn.gpteng.co, the Lovable site builder's, which the user is not told about. Its registry data comes from The Graph's gateway.

• cid:bafybeic5icomycnns3layg3ihdeejxrdtgv2aixra4qf24wwgqwcqqw27y

Evidence

• https://github.com/gmkung/immutable-frontends

IPFS blog

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

A build of the IPFS blog, open source (MIT). Its home page runs no third-party code and makes no request beyond its own files, which is Level 3. It is not judged Level 4: many of its files, posts and sitemap included, could not be fetched from IPFS on 2026-10-05, so what they load could not be checked.

• cid:bafybeiai4km4vbq3ecjgzp2paz7plvwjszhjwmeyp6ekm72dfbwrdxfq3y

Evidence

• https://github.com/ipfs/ipfs-blog

IPFS documentation

evaluated 2026-10-05

Level 2 of 4Supports DDOC

A build of the IPFS documentation, open source (MIT for code). It is not Level 3: when it opens it loads Google Analytics and SpeedCurve's performance monitoring script.

• cid:bafybeiara3xdqrrxfqvzlyuf7x42u64c7pnfatjuvvzadhiwhmltsfu4ee

Evidence

• https://github.com/ipfs/ipfs-docs

IPFS

evaluated 2026-10-05

Level 2 of 4Supports DDOC

An old build of the ipfs.io website, from the archived open-source repository (MIT); the IPFS project's current site is ipfs.tech. It is not Level 3: when it opens it loads Google Analytics and a script from camp.ipfs.io.

• cid:bafybeiddamod5xk4uipjz52xodu4z62ul5xk6lzo3qaiz32yc3t6vd7xqa

Evidence

• https://github.com/ipfs-inactive/website

IPLD

evaluated 2026-10-05

Level 2 of 4Supports DDOC

The IPLD website, open source (Apache-2.0 or MIT). It is not Level 3: a YouTube player embedded in the page loads Google's code as soon as the page opens, before the reader chooses to play anything. It also loads Google Fonts.

• cid:bafybeiejnahivksp7lksmpfbl4anfsywx2zlqx2xlfch5xq5226iw3dvnq

Evidence

• https://github.com/ipld/ipld

James Carnley

evaluated 2026-10-05

Level 4 of 4Trustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless

James Carnley's homepage, open source (MIT). It loads only its own files. Its videos are the one connection elsewhere, and the page says so: pressing play loads the video from YouTube, and until then nothing on the page talks to Google. That keeps it Level 4. It is not private: once a video plays, YouTube sees the reader's IP address, with no proxy in between.

• cid:bafybeiahrsvfblmcdvurapna2mapbl774utjpfyg6bxe2cqpijxjcpzop4

Evidence

• https://github.com/JamesCarnley/JamesCarnley.eth

JSONAPI.ETH

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

The page of JSONAPI.ETH, an ENS resolver that answers onchain queries as JSON. Its source is public (no licence file) and it runs no third-party code, which is Level 3. It is not Level 4: a query runs through an RPC endpoint and the resolver's off-chain gateway, run by its authors, whose answers the page does not check.

• cid:bafybeicn7yegbpc4l2lcazaa3czed6p6nnldsluizam6nrfphu6rujs37m

Evidence

• https://github.com/namesys-eth/jsonapi.eth

Mandalas

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Mandalas, onchain generative NFTs, open source (AGPL-3.0). It runs no third-party code, which is Level 3. It is not Level 4: when it opens it reads the chain through ethereum.etherplay.io, an RPC endpoint run by the author, without a light client.

• cid:bafybeigcm37dmt23dcsyd4akr22fbqj67g4zaaiez5jpgrvuqy2onwamga

Evidence

• https://github.com/wighawag/mandalas

OpenScan

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

OpenScan, a block explorer for Bitcoin and EVM networks, open source (MIT). It runs no third-party code, which is Level 3. It is not Level 4: when it opens it queries dozens of public RPC endpoints and Bitcoin APIs, contacts WalletConnect and loads Google Fonts. The endpoints can be changed in its settings, but the defaults are not checked against the chain.

• cid:bafybeidh6kbbkbqqjnbzg3lpwyl4iljwiiiz4crircphztlpph7watuzo4

Evidence

• https://github.com/openscan-explorer/explorer

PinMe

evaluated 2026-10-05

Level 2 of 4Supports DDOC

PinMe's website. Its public repository is the PinMe command-line tool, not this site, which is a minified bundle with no public source, so it stays at Level 2. When it opens it calls PinMe's servers and GitHub's API, and loads Google Fonts.

• cid:bafybeih732i62xph3ul4zrorx6xv7mbqgahdjuifzgvrncmlxfc5zodx4a

Evidence

• https://github.com/glitternetwork/pinme

Planet

evaluated 2026-10-05

Level 2 of 4Supports DDOC

A Planet-generated site published at planetable.eth, built with Planet's Plain template, whose source is public (no licence file). It is not Level 3: when it opens it loads Plausible's analytics script.

• cid:bafybeiaq7c7dnu3f5w5vrt5hblowwa5jaefz7tk2e72awx5f3q7gwsjska

Evidence

• https://github.com/Planetable/SiteTemplatePlain
• https://github.com/Planetable/Planet

Project DAVI

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Project DAVI's landing page. Its source is public (no licence file) and it runs no third-party code, which is Level 3. It is not Level 4: when it opens it loads Bootstrap's stylesheet from jsDelivr and Google Fonts.

• cid:bafybeibddbldzdbkzt3nudrnioalohygluxz432l3ganicivkaxkzzdiq4

Evidence

• https://github.com/DXgovernance/davi-landing-nextjs

Raffy

evaluated 2026-10-05

Level 4 of 4+ privacyTrustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless; privacy: every activity, including connections and operations, is privacy preserving; no connection shows the user to another party, even with consent

Raffy's personal page: hand-written HTML served as written, so its source is public. It loads only its own files (its pictures included) and runs no script, so it makes no request beyond the site itself.

• cid:bafybeigwepyt4j7hbnrj3fyi263cu53kx2jrdqsgrsbdonnzl62t6xrxz4

Evidence

• https://raffy.eth.limo/

Reality.eth

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Reality.eth, the crowd-sourced oracle's app, open source (GPL-3.0). It runs no third-party code, which is Level 3. It is not Level 4: when it opens it reads the question list from an indexer, indexer.reality.gwei.name, without proof.

• cid:bafybeiapygr75kndtqcjgirmjj6bxfvijiswjjby5hehymzfir7e3dobgy

Evidence

• https://github.com/RealityETH/monorepo

Rekt

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Rekt News. No public source was found for this site, and when it opens it loads Google Tag Manager, so it stays at Level 2.

• cid:bafybeihtdfdy5if4sebuvszhhmanq4obmqpeg2qptdwuv5vsdmmat43ory

Remix IDE

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Remix IDE, open source (Apache-2.0). It is not Level 3: when it opens it loads Font Awesome's kit script from kit.fontawesome.com, third-party code with no integrity hash that the provider can change at any time. It also embeds an X timeline, and fetches compiler lists and plugin data from several hosts.

• cid:bafybeianiyelez5ncziqssvciyndefwp5fjeh6bmutu7gq3lf6coif4tle

Evidence

• https://github.com/remix-project-org/remix-project

Resupply

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Resupply's stablecoin app. No public source was found for this frontend: the project's public repository holds its smart contracts only, so it stays at Level 2. What it reaches after a wallet connects was not checked.

• cid:bafybeiedkg5xxxysibyzr2bzobzkdap2gizrk7aq2mozjyqv5yk7uuk7uq

Evidence

• https://github.com/resupplyfi/resupply

Revnet

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Revnet's site, a page built with Planet's Croptop template, whose source is public (no licence file). It is not Level 3: when it opens it loads Plausible's analytics script. It also reads from public RPC endpoints and a testnet indexer.

• cid:bafybeihf7nllybo3e2fb5c5etwc2dxvt5ydxbolnpjvfxo74sjtqi4n6ju

Evidence

• https://github.com/Planetable/SiteTemplateCroptop

RicMoo

evaluated 2026-10-05

Level 4 of 4+ privacyTrustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless; privacy: every activity, including connections and operations, is privacy preserving; no connection shows the user to another party, even with consent

Pac-Txt, a Pac-Man and Zork mash-up by RicMoo: one self-contained page served as written, so its source is readable in what it serves (an in-file notice licenses it CC BY-NC 3.0). It runs only its own code and makes no network request, opened or played.

• cid:bafybeihatfz6rspdshfqmo6wmvbvnzsobtwo26cyukniyanrmxrquxvvxy

Evidence

• https://ricmoo.eth.limo/

Rocket Sweep

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Rocket Sweep, a tool for Rocket Pool node operators, open source (MIT). It is not Level 3: when it opens, its wallet library loads WalletConnect's hidden verify frame, third-party code the user has not asked for. Chain data comes from an Alchemy key built into the bundle and Cloudflare's Ethereum endpoint.

• cid:bafybeifx45lmgm2nd36anj7wjvzcombx4d4vdb5cpqsvwvzg3za3ojgpnu

Evidence

• https://github.com/dmccartney/rocketsweep

Ronan Sandford

evaluated 2026-10-05

Level 4 of 4+ privacyTrustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless; privacy: every activity, including connections and operations, is privacy preserving; no connection shows the user to another party, even with consent

Ronan Sandford's personal site. Its source is public (no licence file) and it loads only its own files, on every page, so it makes no request beyond the site itself.

• cid:bafybeicdp4k4ygepdb3se65nc3dccpi3kj5wsjf22f23z56qfi3untvnma

Evidence

• https://github.com/wighawag/ronan-eth

Safe

version web-v1.99.2 · evaluated 2026-10-05

Level 2 of 4Supports DDOC

Safe{Wallet}'s official IPFS build, open source. It is not Level 3: when it opens it loads Google Tag Manager and Google Analytics. Accounts and transactions are read from Safe's client gateway (safe-client.safe.global), a server Safe runs.

• cid:bafybeifutotmr72fttru6r4hsrhr44q4qit3vovb7brv4dy5754y4cl6zq

Evidence

• https://github.com/safe-global/safe-wallet-monorepo
• https://github.com/5afe/safe-wallet-ipfs/releases

Seedit

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Seedit, a peer-to-peer alternative to Reddit on the Plebbit protocol, open source (GPL-3.0). It runs no third-party code, which is Level 3. It is not Level 4: when it opens it reads its default community list from raw.githubusercontent.com, a file GitHub serves and nothing checks.

• cid:bafybeihsu5pjlof2xjrnfc7onqrsf4zjb4tgelcx44qo52uncelgeojeky

Evidence

• https://github.com/bitsocialnet/seedit

Simple Page

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Simple Page, a tool to publish a Markdown site at an ENS name, open source (GPL-3.0). It runs no third-party code, which is Level 3. It is not Level 4: when it opens, its own code reports the visit to Plausible and reads from a Tenderly RPC endpoint and the project's servers.

• cid:bafybeih35kufar7qoh437usra2fhtqbhroczngcjlvf77tznbcjkzkuba4

Evidence

• https://github.com/stigmergic-org/simplepage

SmokeSignal

evaluated 2026-10-05

Level 2 of 4Supports DDOC

SmokeSignal, a forum whose posts are Ethereum transactions. Its source is public (no licence file). It is not Level 3: when it opens it loads Google Tag Manager and Facebook's tracking script. Posts are read from Infura and a Gnosis Chain RPC endpoint.

• cid:bafybeigd6em26itq3v6kz2gvwjnng6eygeb36ih7wrb32bh4mxdibcacwy

Evidence

• https://github.com/team-toast/SmokeSignal

Stackly

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Stackly's recurring-purchase app on CoW Protocol. Its source is public (no licence file). It is not Level 3: when it opens it loads Fathom's analytics script. Token lists come from CoinGecko and chain data from a public RPC endpoint.

• cid:bafybeidpn53iznpgs5yr6gg2owog3jzxbk2hrk3oqyg6m4jufymgvrzyuq

Evidence

• https://github.com/SwaprHQ/stackly-ui

Steve Simkins

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Steve Simkins' personal site, open source (MIT). It is not Level 3: when it opens it loads Umami's analytics script. It also fetches icons from the Iconify API.

• cid:bafybeidelyzmwrfeciizo7txtleditercivgjnzi6oiypxcugzi74a3sum

Evidence

• https://github.com/stevedylandev/stevedylan.dev

StorageBeat

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

StorageBeat, a comparison of decentralised storage services, open source (MIT). It runs no third-party code, which is Level 3. It is not Level 4: when it opens it loads KaTeX's stylesheet from jsDelivr.

• cid:bafybeiftl6ixglhmrh32nj4irw473t65vewmcupw72sx7ditzectuevv7i

Evidence

• https://github.com/uncloud-registry/StorageBeat

Swapr

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Swapr's exchange app, open source (GPL-3.0); its README names swapr.eth as where releases are published. It is not Level 3: when it opens it loads Fathom's analytics script. It also reads from many endpoints at once: Infura and other RPCs, LI.FI, The Graph, Etherscan, token lists and an unpkg script host.

• cid:bafybeieiwbszcjx5j6z3373krzbxmzacbagathnsljtokpx62n5rfcqmr4

Evidence

• https://github.com/SwaprHQ/swapr-dapp

The Lounge

version 4.5.2 · evaluated 2026-10-05

Level 4 of 4Trustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless

A self-hosted IRC client whose server runs inside Orivon on this computer. Its code is open source and it runs only what it ships. Each IRC network is run by its operators, who can read, alter or drop what passes through their servers, and a user joining a network clearly knows that; history and settings stay on this computer, and link previews are off until turned on. That is Level 4 under the exception for evident trust. Not private: each network sees your IP address and what you say.

• sha256:b6761c9738dab8dae6c3ac00c9d048e26992ebbd5f095601f1b8e4782ee24cb2
• cid:bafybeieqer67ojhi6q3eiatmrcu3r3mqjehn7hwit2satqjfnljo65fb4q
• sha256:6754d29ca7613c880b518f887fa6c2117e0a45708f09e4de6e183c9c0b6db48a
• cid:bafybeibnrohdwzriv3fvfscr6sfeh5akn76as6m6i4kh2lvczrhceu5yqu
• sha256:fe18c4b724661a0df451c43cc920fe20664272a61b877ff54ad399d2ebc030b2
• cid:bafybeicub3q45zdnvlnnivi574mnh4vujo2fwxcxnf4yegqp2rc7heijey

Evidence

• https://github.com/thelounge/thelounge
• https://thelounge.chat/docs
• https://github.com/OrivonBrowser/orivon-ports/tree/main/apps/the-lounge

v1rtl

evaluated 2026-10-05

Level 2 of 4Supports DDOC

v1rtl's blog. It makes no request beyond its own files, but its scripts are a minified build, and the source it links on Radicle could not be fetched from any seed on 2026-10-05, so public source is not established and it stays at Level 2.

• cid:bafybeifaacimfxna75ngyssypimjlegd4bduif7cnkbt3qv6re5g66pknm

Evidence

• https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3iUqXqcRxvJLmfrj4VroqeS57ine

Velodrome

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Velodrome's trading app on Optimism and other Superchain networks. No public source was found for the frontend (the project publishes contracts, SDKs and docs), so it stays at Level 2. When it opens it reads chain data from Alchemy and dRPC endpoints and contacts WalletConnect's servers.

• cid:bafybeibf66myaaw64ottwtbxh6cxnck34pdefpkrifyo5uht3thhihdjam

Evidence

• https://github.com/velodrome-finance

Vitalik Buterin's blog

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

Vitalik Buterin's blog. Its source is public (the README dedicates the posts to the public under the WTFPL) and it runs no third-party code, which is Level 3. The home page makes no request of its own. It is not Level 4: some posts load images from other hosts (vitalik.ca, Medium's image server, Imgur, Wikimedia and others) when they are read.

• cid:bafybeigqyo555suvqi3scc2izft3mozskktbtkzs2xghoe2rpxetxbbdiq

Evidence

• https://github.com/vbuterin/blog

Walletbeat

evaluated 2026-10-05

Level 4 of 4+ privacyTrustless operations (Level 4) and connections (Level 2), except what the user clearly knows is not trustless; privacy: every activity, including connections and operations, is privacy preserving; no connection shows the user to another party, even with consent

Walletbeat, ratings of Ethereum wallets for security and privacy, open source (MIT). Its data ships inside the site: across 80 of its pages it loads only its own files, runs no third-party code and makes no request beyond the site itself.

• cid:bafybeiecddp4agiwwqbya5qji7tzlfnp3jksf4tbw4jeabrvitzluzljgm

Evidence

• https://github.com/walletbeat/walletbeat

Weald Technology

evaluated 2026-10-05

Level 2 of 4Supports DDOC

Weald Technology's site. No public source was found: it is a generated site with a minified script, so it stays at Level 2. When it opens it loads Google Fonts and calls api.vireli.co.

• cid:bafybeiakrm2levbf5om4pjoarxznwpht6hvwtj4t3nft3db7brv3lglwvu

WebHash

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

WebHash's website. Its source is public (no licence file) and it runs no third-party code, which is Level 3. It is not Level 4: when it opens it loads Google Fonts and fetches a testimonials widget's settings from Senja.

• cid:bafybeig45aqpm4lzjmxkafiujwma6kpniiseuzec65em7hvbumsnsuc2eu

Evidence

• https://github.com/WebHash-eth/website

z0r0z

evaluated 2026-10-05

Level 3 of 4Open source; runs no external code without the user's willing, aware consent

An essay by z0r0z on scaling Ethereum with singleton contracts: one hand-written page served as written, so its source is public, and it runs no script of its own or of others, which is Level 3. It is not Level 4: when it opens it loads images from the ipfs.io gateway and content.wrappr.wtf.

• cid:bafkreicugs5dr24bh22zkwbr4655ocr5illdkstd5jd7ydbditjqeykysu

Evidence

• https://z0r0z.eth.limo/

ZeroLend

evaluated 2026-10-05

Level 2 of 4Supports DDOC

ZeroLend's lending app. The served build matches no public source: the only public frontend is an older, Aave-derived UI, so it stays at Level 2.

• cid:bafybeibfvkztxjwtm6o6t56tsg27omyb5whqgvnnywzfback46wfl7khz4

Evidence

• https://github.com/zerolend/frontend-legacy