Small tools. No accounts. Nothing leaves your browser.
What it grants, what is stored, and how to check rather than trust.
Public repositories work with no account. Connecting is only useful for two things: counting private repositories, and spending your own GitHub rate limit instead of the shared one.
This deployment asks for exactly what /api/meta reports under
oauth_scopes, and the sign-in section on the counter page states it
before you click. GitHub shows the same list on its own consent screen, and that screen, not
anything written here, is the authority.
read:user | Your login name and avatar, so the page can say who is connected. Nothing else. |
|---|---|
| no scope | GitHub App mode. Permissions come from the app (contents: read), and you choose which repositories it may see when you install it. |
repo | Only if a deployment explicitly opts in. This is GitHub's read and write scope for private repositories, and classic OAuth Apps have no read-only equivalent. If you see this requested, it is worth asking why. |
| Your access token | In Cloudflare KV, under a random 256-bit session id. It expires after 7 days. It is never sent to your browser. |
|---|---|
| Your browser | One cookie holding only that session id: HttpOnly, Secure, SameSite=Lax. JavaScript on the page cannot read it. |
| Your code | Never stored. Files are decoded, counted, and discarded as they stream past. Only totals are kept. |
| Private results | Cached under the commit sha like any other, but a cached private result is never served without re-checking that the caller can still see the repository. |
api.github.com and
codeload.github.com, and the token is never attached to the second one.The whole thing is open source, so none of the above has to be taken on faith.
src/worker/auth.ts
holds the entire sign-in flow, including what is requested and where the token goes.src/lib/github.ts
lists every GitHub request the app can make. All of them are GETs.source_commit: the commit this running
build came from. Compare it with the repository to confirm the deployed code is the published
code.api.github.com and never to the archive host. Both fail if the protection is
removed.Reading the source proves what the repository says. It does not prove that is what your browser received, and after adding a page that generates Monero keys that stopped being an academic distinction: an altered script on a single day would harvest everything made that day, and would look entirely normal.
So there is a command that compares them, and it needs nothing but a clone and node:
git clone https://github.com/letsgettoworkbro/countlinesofcode cd countlinesofcode && npm run verify:live
It fetches every asset from the live origin, hashes it, and prints anything that differs from the working tree. A difference is usually an ordinary deploy lag: check out the commit /api/meta reports and run it again. A difference that survives that is worth reporting.
The honest limit, because it matters: run by the same party who could have altered the site, this proves nothing at all. Anyone able to change what is served could change what the check reports. It is written to be run by other people, on their own machines, and the strongest version is two people who have never spoken running it independently and getting the same hashes.
The third-party libraries served here whole (pdf.js, OpenPGP.js, mediabunny,
Tesseract, libheif, libarchive, LAME, and the Monero wallet worker) are pinned
by hash in
src/lib/vendor-hashes.ts,
and the test suite fails if any of them changes. There is other third-party
code too: the @noble and @scure cryptography is
bundled into the wallet and PGP scripts. But these eight are the large ones
served as their own files, which makes them the place worth watching.
“Disconnect” on the front page deletes the stored token immediately. To revoke from GitHub's side, which is the one that does not depend on trusting this site, use GitHub → Settings → Applications. Doing that is always the stronger move, and it works whether or not anything here is true.