# Verify it yourself

> Do not take our word for anything. The client source, the egress manifest, and the CI test that enforces it are public. Here is how to check each one.

- Source: https://awaitful.com/docs/verify-it-yourself
- Updated: July 19, 2026

Every service in this market says it does not read your code. Saying it proves nothing, so this page is not an argument - it is the list of artifacts you can open, read, and use to catch us lying. If any of these links ever dead-ends, treat the claim it backs as withdrawn.

## The three receipts

1.  ### Read the client source
    
    [The client that runs on your machine](https://github.com/Awaitful/awaitful) is public, in full: the extension, the surfaces, the patch engine, the event reporting. Every client behavior these docs claim can be checked against this source.
    
2.  ### Read the egress manifest
    
    [The egress manifest](https://github.com/Awaitful/awaitful/blob/HEAD/PRIVACY.md) is the plain-English contract for everything that leaves your machine, request by request, field by field. It is short, because the list is short - the same list as [What leaves your machine](https://awaitful.com/docs/what-leaves-your-machine).
    
3.  ### Read the test that enforces it
    
    [The CI egress test](https://github.com/Awaitful/awaitful/blob/HEAD/packages/shared/src/__tests__/egress.test.ts) pins the exact field set of every request schema. Add a field or rename a field, and the build fails until the manifest is updated to admit it. This is the strongest artifact of the three: the promise is enforced by CI, not by our word.
    

## How to actually check

Open the test and read the pinned key lists - they are literal arrays of field names, one per request type. Compare them against the manifest's tables. Then note the stripping rule: the schemas discard unknown fields on parse, so even a compromised client build could not smuggle a payload through a schema that does not name it.

**The installer has receipts too**

The [npx installer](https://www.npmjs.com/package/awaitful) is dependency-free and makes no network requests of its own - enforced by its test suite in the public repo, which scans the shipped source for network primitives. What it does, and every flag, is in the [CLI reference](https://awaitful.com/docs/cli-reference).

## What verification cannot do

Honesty cuts both ways: reading the source proves what the client does, not what any server does. That is exactly why the client is built to send so little - the safest data is the data that never leaves. The billing rule that follows from this design is in [What counts as an impression](https://awaitful.com/docs/verified-impressions), and the editor safety engineering is in [Your editor never breaks](https://awaitful.com/docs/editor-safety).

## Found something? Report it

Security research has a front door here. Reports go to [security@awaitful.com](mailto:security@awaitful.com), the disclosure policy is public in [SECURITY.md](https://github.com/Awaitful/awaitful/blob/HEAD/SECURITY.md), and a machine-readable contact lives at `/.well-known/security.txt`, the standard place (RFC 9116). We read reports promptly and answer honestly - the same contract as everything else on this page.

The response headers this site serves are themselves checkable: [scan them yourself](https://securityheaders.com/?q=awaitful.com) rather than taking a badge's word for it.