Caddy is a production-grade, extensible web server platform written in Go. It automatically manages HTTPS certificates (via ACME/ZeroSSL) and provides a rich set of HTTP middleware including reverse proxy, file serving, authentication, compression, and headers manipulation. The architecture is modular: all features are registered as Caddy modules following a consistent lifecycle (Provision/Validate/Cleanup) and configured via a JSON config or the Caddyfile adapter. Key entry points are the CLI (caddy run, caddy start, etc.) and the admin API for runtime config changes. Primary data flows involve incoming HTTP requests being processed by a middleware chain of matchers and handlers, with TLS termination handled by the TLS app. External dependencies include certmagic for certificate management, zap for structured logging, Prometheus for metrics, and OpenTelemetry for tracing. The codebase is actively maintained with extensive test coverage and fuzz testing.
This is a full-stack web application for performing open-source intelligence (OSINT) analysis on any website. The system runs 40+ checks encompassing DNS, SSL/TLS, HTTP security headers, mail configuration (SPF/DKIM/DMARC), social media presence, trackers, blocklists, threat feeds, carbon footprint, tech stack, and more. The frontend is built with Astro and React, featuring a reactive results view with a masonry grid, advisory panel, and progress bar. The backend is a Node.js Express server (also serverless-friendly) with individual API handlers per check, wrapped in a common middleware layer for error handling, rate limiting, and skip logic. The application is designed for self-hosting and supports deployment to Vercel, Netlify, Docker, Render, and Fly.io. It relies on many external sources (DNS, WHOIS, SSL Labs, HIBP, Google Safe Browsing, Shodan, etc.) and uses Puppeteer/Chromium for headless browser tasks. The codebase demonstrates a clean modular architecture, reusable UI components, and a novel analysis rule system that transforms raw data into structured findings with severity levels.
Plausible Analytics is a production-grade, privacy-first web analytics platform implemented as a full-stack SaaS application. The backend is built with Elixir/Phoenix (LiveView, Ecto, Oban) and uses ClickHouse as the primary analytics data store alongside PostgreSQL for transactional metadata. The frontend is a React/TypeScript single-page application with Tailwind CSS, and a separate JavaScript tracker script is distributed via npm and self-hosted CDN. The system handles event ingestion, session management, real-time dashboards, goal/funnel tracking, billing/subscriptions via Paddle, team collaboration, SSO/SAML authentication, data imports from Google Analytics, and a public Plugins API. The codebase is dual-licensed (Community Edition and Enterprise Edition) with conditional compilation for EE features like consolidated views, customer support tools, and audit logging. The architecture is modular with clear contexts (stats, ingestion, billing, teams, auth, shields) and extensive use of Oban workers for background jobs, ConCache for distributed caching, and OpenTelemetry for observability. The repository demonstrates high engineering craftsmanship with comprehensive test coverage (ExUnit, Playwright, k6 load tests), well-structured abstractions (cache behaviour, rate limiter, write buffers, session balancer), and a clear separation of concerns between the Phoenix web layer, LiveView components, and the React dashboard.
Awesome Privacy is a curated directory of privacy-respecting software and services, accessible via a public website and API. The repository centers around a single source of truth YAML file (`awesome-privacy.yml`) that catalogs tools across categories like Essentials, Communication, and Security Tools. This data is processed by a Python-based toolchain (`lib/`) for validation, changelog generation, and README updates, while a modern web frontend (`web/` built with Astro and Svelte) provides interactive browsing and search, and a TypeScript API backend (`api/` using Hono) serves JSON endpoints and enriches service data with metadata from external sources like GitHub, Docker Hub, and app stores. The architecture cleanly separates data, processing, and presentation layers, with robust caching, rate limiting, and authentication in the API, and client-side search via MiniSearch in the web app. The project emphasizes maintainability through automated PR checks, dependency management, and clear contribution guidelines, though it relies on numerous third-party APIs for enrichment, introducing potential external dependency risks.
Presidio is a production-grade PII detection and anonymization framework. It operates as both a Python library and a set of microservices (Flask REST APIs) for detecting and redacting personally identifiable information (PII) in text, images (including DICOM), and structured/tabular data. The system is built around three core engines: the Analyzer (entity recognition via regex patterns, NLP models, and LLMs), the Anonymizer (applies operators like replace, redact, mask, hash, encrypt), and the Image Redactor (OCR-based text extraction and bounding-box redaction). A CLI tool and a structured data engine complement the main services. The architecture is modular and extensible: recognizers are pluggable (predefined regex-based, NLP-based, or custom), anonymization operators follow a consistent interface, and NLP engines (spaCy, Stanza, Transformers, GLiNER, HuggingFace) are swappable via YAML configuration. The system supports context-aware detection, score thresholds, allow/deny lists, and batch processing. External dependencies include NLP libraries, OCR (Tesseract), cloud services (Azure AI Language, Azure Health Data Services), and LLM providers (Azure OpenAI, Ollama). Key entry points include the AnalyzerEngine.analyze() method, AnonymizerEngine.anonymize(), the REST endpoints (/analyze, /anonymize, /redact), and the presidio-cli command-line tool. The primary data flow is: input text/image → Analyzer (detects entities with scores) → Anonymizer (applies operators) → output. For images, OCR extracts text before analysis. The system is designed for compliance with data privacy regulations (GDPR, HIPAA, etc.) and is used in production deployments with Kubernetes, Azure, and Spark.
SearXNG is a privacy-respecting metasearch engine that aggregates results from over 100 search engines (Google, Bing, DuckDuckGo, Wikipedia, academic sources, etc.) via HTTP requests. It runs as a Flask web application, supports multiple output formats (HTML, JSON, RSS), and includes a plugin system, bot detection, rate limiting, and user preferences stored in cookies. The architecture is a monolithic Python application with a separate TypeScript/Less frontend built with Vite. It uses Valkey/Redis for caching and rate limiting, and SQLite for persistent caches. The codebase is well-structured with a clear separation of concerns: engine modules implement a common request/response interface, result types are typed with msgspec, and plugins are registered via a simple hook system. It is actively maintained with CI/CD, Docker support, and comprehensive documentation.
This repository is a web application for generating privacy policies and terms of service for mobile and web apps. Built with Vue.js 3 and Bulma CSS, it features an 8-step wizard interface where users configure policy type (Simple, No Tracking, GDPR), app details, platforms, features, and third-party services. The application generates customized HTML/Markdown policies deployable to Flycricket or downloadable directly. It includes a PWA with service worker for offline support, internationalization (English/German), and a persistent theme toggle. The architecture centers on Vue composables for state management (app state, wizard navigation, content generation) and a Go-based build system that processes Go templates, compiles Less to CSS, and minifies assets. Key reusable patterns include modular template mixins, a flexible modal system, and utility functions for DOM manipulation. An ancillary tool in `tools/reviews-page-generator` fetches GitHub issue comments to generate a static testimonials page. The codebase demonstrates strong engineering practices: comprehensive Playwright test suite, golden HTML regression tests, dependency management via Go modules and package.json, and automated deployment workflows. While the custom build pipeline adds slight complexity, the separation of concerns and reusable components indicate maintainable, craftsmanship-driven development.
Maigret is a username-based OSINT reconnaissance tool that checks across thousands of websites for accounts associated with a given username, extracts profile information via the socid_extractor library, and generates multi-format reports (HTML, PDF, CSV, JSON, Markdown, XMind, Neo4j, etc.). It operates as a CLI tool, an embeddable Python library, a Flask web application with live scan streaming, and a Docker image. The architecture is a monolith with a clean separation between site database management (MaigretDatabase/MaigretSite models), asynchronous checking engine (AsyncioQueueGeneratorExecutor, checkers for aiohttp, curl_cffi, Cloudflare bypass), extraction enrichment, and report generation. External dependencies include aiohttp, socid_extractor, curl_cffi, aiodns, and potentially FlareSolverr and OpenAI-compatible APIs (optional). The tool supports proxy/Tor/I2P routing, self-validation of site configurations, and auto-update of its site database. It is actively maintained, with frequent releases and a large community, and is used by professionals in OSINT, academic research, cryptocurrency investigations, and privacy analysis.
AdGuard Home is a production-grade, self-hosted network-wide ad/tracker blocking DNS server. In operation it listens for DNS queries, applies filtering via blocklists, custom rules, parental control, safe search, and DNS rewrites, forwards remaining queries to upstream resolvers over plain DNS, DoT, DoH, or DoQ, and records query logs and statistics. It also includes a DHCP server for IPv4/IPv6, client identification through ARP/WHOIS/rDNS/DHCP/hosts files, TLS/encryption management, and a REST API documented in the openapi directory. The Go backend is a modular monolith organized into domain packages such as dnsforward, filtering, querylog, stats, dhcpd/dhcpsvc, home, and the new next/websvc, with heavy use of interfaces and OS-specific build tags for Linux, macOS, Windows, FreeBSD, and OpenBSD. The repository ships two frontends in parallel: a legacy React/Redux application under client/ and a newer SolidJS application under client_v2/, both built with webpack and backed by the same HTTP control API. Entry points include main.go for the stable product and main_next.go for an ongoing architectural rewrite. Configuration is stored in YAML and migrated through 34 schema versions using a dedicated migration framework. The codebase is extensively tested at both unit and end-to-end levels, and release packaging scripts cover many OS/arch targets. The presence of JSON tracker metadata and safe-search rule lists is operational data, not research artifacts; this is not a data pipeline or analytics repository. Primary data flows: DNS request -> dnsforward request handler -> client identity lookup -> filtering engine (urlfilter, custom rules, hosts) -> safe-search/rewrite handling -> upstream forwarding -> response; each query is written to a binary query log and aggregated into statistics. DHCP leases persist through JSON databases, and embedded datasets such as whotracksme metadata and blocked-services definitions support UI and filtering behavior. The largest current risk is the dual-frontend and dual-backend transition, which creates duplication and increases maintenance burden, but the core DNS/DHCP/filtering paths remain coherent and well-tested.
This repository is a build tooling and patching infrastructure for producing a de-Googled Chromium browser. It does not contain the browser itself but provides the configuration files, patches, and scripts needed to download, modify, and build Chromium without Google web service dependencies. The architecture consists of several layers: configuration files (flags.gn, pruning.list, domain_substitution.list, downloads.ini) that define what to remove or alter; source file processors (binary pruning, domain substitution) that modify the Chromium source tree; a quilt-based patch system with core and extra patches organized by origin (ungoogled-chromium, Bromite, Inox, Iridium, Debian); and utility scripts in the `utils/` and `devutils/` directories for downloading, patching, validating, and building. Key entry points include `utils/downloads.py` for fetching Chromium source, `utils/patches.py` for applying patches, `utils/domain_substitution.py` for replacing Google domains, and `devutils/validate_config.py` for sanity checks. The primary data flow is: clone Chromium source → prune binaries → apply patches → substitute domains → build with GN flags. External dependencies include the Chromium source tree, quilt, Python 3, and platform-specific build tools (e.g., ninja, clang). The project is actively maintained with CI workflows that validate patches and check for new Chromium versions, but it is tightly coupled to specific Chromium releases, requiring constant patch updates.
AnyType is a personal knowledge base application built with Electron, React, and TypeScript. It features a block-based system for creating and connecting information (text, databases, kanban, calendar, custom types) with offline-first storage and optional peer-to-peer synchronization. The application uses a modular architecture with a Go-based middleware (anytype-heart) communicating via gRPC, MobX for state management, and an extensive reusable UI component library. It includes browser extension support for web clipping and AI agent extensibility.
fhevm is a production-grade, full-stack confidential smart contract platform that brings Fully Homomorphic Encryption (FHE) to EVM-compatible blockchains. The system is a distributed microservices architecture: on-chain Solidity contracts (host-contracts for ACL, FHEVMExecutor, KMSVerifier, InputVerifier, ProtocolConfig, and gateway-contracts for decryption/input verification) handle encrypted state and access control, while a suite of Rust services (coprocessor/fhevm-engine with host-listener, gw-listener, tfhe-worker, sns-worker, transaction-sender, zkproof-worker, scheduler) perform off-chain FHE computation, ZK proof verification, and transaction submission. A relayer service exposes HTTP v2/v3 endpoints for public/user/delegated decryption with EIP-712 typed-data attestations, and a KMS connector manages threshold key generation and decryption. The TypeScript SDK (ethers and viem adapters) provides client-side encryption, decryption, and proof generation with WASM-based TFHE/TKMS modules, plus a CLI and load-testing toolkit. Cross-chain bridging via LayerZero V2 is included for confidential token transfers.
hBlock is a POSIX-compliant shell script that downloads multiple ad, tracking, and malware domain blocklists from curated sources, processes them into a unified hosts file (or alternative formats like dnsmasq, unbound, adblock, Windows PowerShell), and installs it to block those domains at the system level. The core architecture is a single self-contained script (hblock) with a custom option parser, robust error handling, and support for parallel downloads, allow/deny lists, template-based output formatting, and subdomain filtering. It is not a reusable library but a complete CLI tool; however, its companion scripts (resource/alt-formats/*.sh) demonstrate a clean plugin pattern for generating multiple output formats, and the stats script (resources/stats/stats.sh) provides a reusable utility for analyzing domain lists against the Public Suffix List. The project is well-maintained, tested across multiple shells and platforms, and follows strict POSIX shell practices.
FREE Browser is an Android web application focused on privacy and user control. It implements a tabbed browsing interface using Android WebView with extensive privacy protections including ad-blocking via StevenBlack host lists, cookie banner blocking using Mozilla's rule list, and fingerprint protection through JavaScript injection that spoofs canvas, WebGL, AudioContext, and font metrics. The application features granular controls for JavaScript, DOM storage, and cookies per domain, comprehensive bookmark and history management, download handling, and backup/restore functionality for all browser data. The architecture follows Android best practices with separate modules for browser functionality, database handling, preferences, and utility functions, using patterns like MVC, adapter patterns, and singleton for tab management.
BiTchat is a native Swift messaging application for iOS and macOS that provides secure, decentralized communication over Bluetooth Low Energy (BLE) mesh, with optional Nostr and Tor transport. The codebase implements end-to-end encryption using the Noise protocol (XChaCha20-Poly1305), Ed25519 signatures, prekey forward secrecy, and a vouching trust model. It includes rotating peer IDs, fingerprint verification, recognition tags that avoid leaking social graphs, and panic-wipe capabilities. The app is structured around SwiftUI views, view models, and coordinators, with a central ChatTransportEventCoordinator routing inbound transport events (messages, noise payloads, delivery status, verification, peer lifecycle) to the UI layer.
KeePassXC is a cross-platform password manager (Qt Widgets GUI plus CLI) written in C++/Qt. In production it creates, stores, and retrieves credentials in KeePass 2 (KDBX 3/4) database files encrypted with AES, ChaCha20, or Twofish and keyed by Argon2/AES-KDF through the Botan crypto library. It is entirely local-file based — no hosted backend — and adds local integrations: Auto-Type keystroke injection (X11/Wayland/Windows/macOS), YubiKey challenge-response, RFC 6238 TOTP generation, an SSH agent implementing the ssh-agent wire protocol, a FreeDesktop.org Secret Service D-Bus daemon so Linux desktop apps can read stored secrets, browser-extension access via native messaging (including passkey/WebAuthn registration and authentication), and KeeShare encrypted group sharing. The CLI (keepassxc-cli, entry point src/cli/keepassxc-cli.cpp plus src/main.cpp for the GUI) exposes the same core model for scripting: create/edit/show/search/merge databases, generate passwords, analyze HIBP breach exposure, import/export, and dump to CSV/HTML. Architecture is a modular desktop monolith: a core domain layer (src/core: Database/Entry/Group, config, clock, search, password generation, password health), a crypto layer (src/crypto: ciphers, hashes, KDFs), a stream layer (src/streams: hashed/HMAC block streams that give the KDBX format tamper-evident framing), a format layer (src/format: KDBX3/4 readers and writers, CSV parser/exporter, HTML exporter, importers for 1Password OPVault/1PUX, Bitwarden, Proton Pass, KeePass 1), and feature modules (browser, fdosecrets, sshagent, keeshare, autotype, quickunlock) that feed both GUI and CLI surfaces. Platform abstraction lives in OSUtilsBase plus per-OS AutoType/device-listener/screen-lock implementations; background work uses AsyncTask (QtConcurrent) wrappers; several plugin-like interfaces (IReportsPage, IEditGroupPage, ISettingsPage, KeyComponentWidget) allow modular extension. External dependencies: Qt 6, Botan, libsodium, zxcvbn, libusb/PCSC for YubiKey, QuaZip/minizip, and vendored ykcore C code. The test suite is extensive (~100 unit/GUI test files covering format round-trips, crypto known-answer tests, streams, merge, CLI, and browser). Notable weaknesses: heavy conditional compilation (#ifdef for KPXC_FEATURE_BROWSER/NETWORK/SSHAGENT/FDOSECRETS plus platform), near-duplicate report widgets, and a suspected early-return bug in EditGroupWidget::apply() under the browser-feature #ifdef that can skip group save logic, all of which add maintenance friction.
This repository implements an MCP (Model Context Protocol) server that bridges AI assistants with SearXNG, a privacy-respecting metasearch engine. It exposes four primary tools: `searxng_web_search` for web queries, `searxng_search_suggestions` for autocomplete, `searxng_instance_info` for capability discovery, and `web_url_read` for fetching and converting web pages to markdown. The server runs in two transport modes: STDIO (default) for simple MCP integration, and HTTP for stateful/stateless remote access with optional OAuth and static bearer authentication. The architecture is modular and security-focused. Core modules include a proxy layer with per-type agent selection, SSRF protection via private IP blocking and DNS rebinding detection, a browser solver chain (FlareSolverr/Byparr) for challenge solving, worker-threaded PDF extraction, and multi-instance failover/fanout for SearXNG replicas. All credential-bearing output (logs, errors, MCP resources) is redacted by a centralized sanitizer. Extensive environment-variable configuration (~40+ knobs) controls caching, timeouts, rate limiting, TLS, and result formatting. Highlights include a strict integer parser that rejects unsafe or malformed values, an LFU cache with age tie-breakers and configurable TTL, and a comprehensive URL security module covering both IPv4 and IPv6 private ranges. The test suite achieves over 90% line coverage and includes integration, unit, fuzz, and e2e tests, with documentation tests that verify README and configuration docs match source contracts. The project is actively maintained with frequent releases, pinned dependencies, and a verification gate that enforces zero-vulnerability audits before publishing.
Algo VPN is a deployment tool that automates the setup of a personal VPN server on cloud providers or local Ubuntu machines. It uses Ansible to provision a hardened server running strongSwan (IKEv2/IPsec) and WireGuard, with optional DNS encryption via dnscrypt-proxy and privacy enhancements like log rotation and history clearing. The architecture is a set of Ansible playbooks and roles, orchestrated by a shell script entry point (`algo`) that invokes `ansible-playbook`. Cloud provisioning is handled by provider-specific roles (AWS EC2, DigitalOcean, Azure, GCE, etc.), while server configuration roles handle system hardening, PKI certificate generation, VPN service configuration, and client profile generation (mobileconfig, WireGuard .conf, QR codes). The system is designed for security and privacy: it uses strong crypto defaults (ECC secp384r1), minimal logging, and unattended upgrades. External dependencies include Ansible, community.crypto collection, cloud provider SDKs, and the dnscrypt-proxy package. The primary data flow is: user edits `config.cfg` → Ansible playbook runs → cloud VM is created → server is configured with VPN services → client configuration files are generated and stored locally. User management (add/revoke) is handled by a separate playbook. The repository includes extensive unit, integration, and end-to-end tests, with Docker-based integration testing and CI/CD via GitHub Actions.
PySyft is a privacy-preserving data science platform that enables data owners to share private datasets and approve code execution without exposing raw data. The codebase is a monorepo with multiple interdependent packages: `syft` (sync engine, peer management, encryption), `syft-rds` (high-level remote data science client for datasets and jobs), `syft-job` (job lifecycle, runner, disclosures), `syft-datasets` (dataset storage with versioned protocol codecs), `syft-enclave` (confidential computing with TEE attestation via Confidential Spaces or Tinfoil, signed receipts), `syft-bg` (background services for auto-approval, email notifications, systemd management, TUI), `syft-permissions` (declarative ACL engine), `syft-restrict` (static code verification and obfuscation for private regions), `syft-migration` (generic versioned migration framework for objects), `syft-notebook-ui` (rich HTML representation for Jupyter), and `syft-perms` (file-level permission browser). The core workflow: data scientists submit Python jobs encapsulating analysis code → data owners approve (manually or automatically) → jobs run in sandboxed environments or TEE enclaves → results and logs are staged and released according to multi-party disclosure policies. The system uses Google Drive as the default sync transport with offline-first P2P file exchange, protocol versioning for backward compatibility, and cryptographic key pinning for trust.
Pi-hole is a network-wide ad blocking application that operates as a DNS sinkhole. The repository contains the core shell scripts for installation, configuration, and management of the Pi-hole system. The primary entry points are the `pihole` CLI command and `gravity.sh`, which downloads and compiles blocklists into a SQLite database. The architecture is a collection of bash scripts that orchestrate the FTLDNS daemon (a separate binary) and provide a command-line interface for allow/deny lists, querying, debugging, and updates. The code is well-structured with modular functions, error handling, and extensive test coverage across multiple Linux distributions. It is a mature, actively maintained project with a large community.