Check this site yourself

This page is in English only. It does not claim this site is secure — a page served by this machine claiming this machine is fine would say the same thing whether it was or not. It gives you two things you can run, and is straight about what running them proves.

The record's head, right now

06bfa8eb9faf24580f7ad12fcc42c7f66a5bc1c0a74739959056961156a9b099

338 entries, published 2026-10-19 18:18:04 UTC. Every entry's digest covers the one before it, so this single value stands for the whole chain.

What you can check

1. Recompute the whole record

The published record is a hash chain: each entry's digest is taken over the previous digest, the time it was recorded, and its contents. Change anything in the past and every digest after it changes too. You can rebuild all 338 links from the published file and see whether they arrive at the head above.

curl -sS https://security.krd/data/ledger.json -o ledger.json
python3 - <<'PY'
import json, hashlib
d = json.load(open("ledger.json"))
prev = "0" * 64
for r in sorted(d["entries"], key=lambda x: x["seq"]):
    canon = json.dumps(r["summary"], sort_keys=True, separators=(",", ":"))
    dig = hashlib.sha256((prev + "|" + r["recorded"] + "|" + canon).encode()).hexdigest()
    if dig != r["digest"]:
        print("breaks at entry", r["seq"]); break
    prev = dig
else:
    print("chain holds,", len(d["entries"]), "entries")
    print("head", prev)
    print("matches published head:", prev == d["head"])
PY

The algorithm is published in the same file, under algorithm, so you are not taking this page's word for the formula either.

2. Check a published file against its own checksum

Every file in the open dataset is listed in the manifest with its sha256. Download one and compute it yourself:

curl -sS -O https://security.krd/corpus/posture-daily.csv
shasum -a 256 posture-daily.csv
# expected, from /corpus/manifest.json:
# bc4c3c662f3e2fa03e2d684aa6db775d0a6596ddb7671c4f3058010531886857

That tells you the bytes you received are the bytes the manifest describes. It does not tell you the manifest is right — see below.

What that proves

No entry in the record has been edited since it was written, unless every entry after it was rewritten as well and the head changed.
The file you downloaded is the file the manifest describes.
If you noted the head on an earlier visit, you can check that the same entry still carries the same digest today. That is the strongest thing on this page, and it works because the copy you keep is not under this server's control.

What it does not prove

Everything above is published by this server. If somebody held this machine, they could write a new record, recompute the chain over it, publish a matching head and update the manifest. It would all verify. A hash chain stops a record being altered quietly and retroactively; it is not a proof that whoever is publishing it is honest, and this page will not pretend otherwise.

The properties that survive that are the ones this site does not control:

Certificate Transparency. Every TLS certificate issued for this domain is recorded in append-only logs run by other organisations. A certificate nobody here asked for would be visible in them. You can read the full list at crt.sh, which is not us.
A copy you took yourself. Any earlier ledger.json you saved is evidence this server cannot reach.
The archived copies are checksummed when they are written, and the checksums are re-read on a schedule. That catches a file changing on disk. It does not catch a change made at the same time as the checksum.

What this site does to reduce what a reader has to take on trust

Nothing on an archived page runs. Copies of other sites are served under a policy that allows no scripts and no connections of any kind, so opening one cannot execute anything and cannot report you to the site that was copied.
This site receives nothing. There is one form, it accepts one field, and it is a suggestion queue rather than a contact channel. There are no accounts, no comments and no uploads on this domain.
The record is append-only by construction. Corrections are written as new entries that say what was corrected, not as edits to old ones.

If you find something here that does not verify, the useful thing to do is keep the copy that does not match. That copy is the evidence; this page is not.