How the lab works
Built to be checked, not trusted.
The lab is where we test our own tools in the open. These are the rules every lab follows.
Nothing leaves your screen
Labs compute everything in your browser and show it to you. There are no accounts, analytics, cookies or uploads, and pages may only load files from this site: the security policy blocks anything else. Where a tool would reach out anyway (CreepJS's WebRTC test contacts Google's servers), we switch that part off and say so.
Check it yourself
Every lab has a privacy.json listing each file it loads with its fingerprint, the exact source commit, and how to confirm the security policy. Once a lab has loaded, you can turn off Wi-Fi and it keeps working.
Open detectors, run unmodified
Where a well-known open-source tool exists, the lab runs it exactly as published, pinned to an exact commit and reviewed first: BotD from FingerprintJS and CreepJS by Abraham Juliot, both MIT-licensed.
Results with dates and limits
Every published finding says when it was measured, on what, and what it does not cover. A lab shows what its own page can see; it never claims to know what another website runs.
Skills that are safe to hand your agent
Skills are plain text in the open Agent Skills format, with no network access and no downloaded code. Before release, each one passes checks for hidden characters, instruction-hijacking phrasing, requests for secrets and outside links, and every file is fingerprinted.
Why we built it
Our tools browse the web on people's behalf. The lab is how we check, with evidence, that they behave the way we say, and how we find out when they do not. The first thing it caught was our own search tool typing keys no keyboard sends; we fixed it and published both results.