The short version
You should be able to browse Utilitas without creating an account or handing the hub your files. This site is the front door to the collection: it explains the tools, publishes Field Notes, and sends you to the product you choose.
How the hub is kept small
Utilitas has no sign-in, payment flow, public API, or file-upload endpoint. Only the finished website is published. Source files, tests, environment settings, repository history, and development tools are not part of the public site. A made-up or missing address returns a real 404 response instead of exposing a file listing or internal route.
Protections in place
Every page is delivered over HTTPS with security headers added by a Cloudflare Worker. Those headers limit where scripts can come from, prevent other sites from placing Utilitas inside a frame, reduce accidental sharing through referrer data, and turn off browser capabilities the hub does not need. Each HTML response receives a fresh script nonce rather than reusing a fixed value.
Each tool has its own boundary
The hub links to independent products, but it does not run their editors, calculators, file readers, local storage, or exports. If a problem happens inside one of those tools, identify that product in the report and use its security page or repository guidance when available.
Found something wrong?
Please use the reporting guidance on the contact page. Automated security tools can find the same contact and policy details in security.txt. A useful report includes the affected address, what happened, why it matters, and the smallest set of steps needed to reproduce it. Please do not access anyone else's data, disrupt the service, run broad automated scans, or publish an unresolved issue before there has been a reasonable chance to investigate it.
A sensible limit
No website can promise that it will never have a defect. Keep your browser updated, keep original copies of important work, and use an approved offline or managed environment for highly sensitive material.