What this actually proves, and what it doesn't
Each entry below records the SHA-384 hashes of every CSS/JS file live on this site at
deploy time (the same manifest published at /integrity.json),
plus the exact git commit that produced it. Every entry also hashes the previous
entry and includes that hash in its own -- the same construction a hash chain or an
append-only log uses -- so altering any past entry breaks every entry after it. That's what
the verification below actually checks, live, using your browser's own
crypto.subtle, not a number this page just prints.
Honest limit: this log is self-hosted -- committed to the same git repository and served from the same host as the rest of the site. It proves the deploy history is internally consistent, not that it's impossible to tamper with: a host capable of serving different code to different visitors could in principle also serve a consistently-tampered version of this log to itself. Real, airtight protection needs independent third parties fetching and archiving entries over time -- the same reason real Certificate Transparency relies on multiple independent log operators, not one. Treat this as meaningfully more verifiable than a claim in a privacy policy, not as an information-theoretic guarantee.
Verification result
Verifying in your browser…
| # | Deployed | Git commit | Manifest hash | Chain |
|---|
Verify it yourself, independently
Don't take this page's word for its own check. Fetch /transparency-log.json directly and run the same, independent verification as a plain Node script -- no browser, no trusting this page's own JavaScript to grade its own homework:
# from a clone of github.com/iabhi92/haven-tasks
node scripts/verify-transparency-log.mjs