Myrhe𝕏

Searxly ships a full SearXNG instance inside the app bundle and runs it on your Mac. Your queries reach the engines they are meant to reach and nowhere else. There is no Searxly server in the search path, because there is no Searxly server.

Getting there meant deleting Docker. The engine now runs on a relocatable CPython 3.12.13 with every dependency installed as a prebuilt arm64 wheel and zero compilation, all twenty-odd Mach-O binaries codesigned with a hardened runtime so the whole thing survives being moved into an app bundle. That change was one commit: 797 lines added, 1,602 removed, across 21 files.

The rest is the browser you would expect from someone who cares about this. Tor with pluggable transports and per-tab circuit isolation, 257,000 blocking rules compiled across 14 lists, a native results page with client-side ranking, Reader Mode, on-device page translation, and a password vault. It is source available, notarized, and free.

Maximum is one compile flag and one source of truth away from the free app. It forces maximum privacy and Tor at every launch, refuses to be downgraded, and strips out every surface the free app has that touches a network for a non-privacy reason.

The hardening is in the engine, not in JavaScript. WebKit's experimental and internal feature flags are enumerated at runtime and the privacy relevant ones turned off inside the engine: WebRTC, gamepad, NFC, serial, HID, USB, Bluetooth, battery, prefetch, prerender. Real Lockdown Mode and a Tor Browser style Standard, Safer, Safest slider sit on top. Every private call is guarded, so a missing symbol degrades instead of crashing. JavaScript shims stay as the floor, not the ceiling.

Because Maximum blocks native egress in Tor mode, Sparkle could never check for updates, which is a genuine hole. So the updater is replaced. It fetches the appcast over the fail-closed Tor lane, parses it, downloads over a delegated Tor session, and verifies the Ed25519 signature independently with CryptoKit before anything is trusted.

Licensing is offline. An Ed25519 signature verified against a bundled public key, bound to the machine. The app contacts a server exactly once in its life, at activation, and the privacy page says so in those words.

A second target inside the existing Xcode project, sharing a synchronised source group with the Mac app and re-implementing the browser layer as UIKit representables.

It has no wallet, no crypto, no VPN, no Tor, and no bundled search engine. Partly App Review, partly physics. Search rides a hosted instance instead of one on your device, which is a real shift in who you have to trust. The product page says that plainly rather than burying it, because the alternative is a privacy app that lies in its first paragraph.

It is on public TestFlight now. The floor is iOS 26, which keeps the tester pool small and was a deliberate trade for Liquid Glass.

An iPhone app and a local daemon that pair over a QR code and talk directly. No relay, no account, no cloud.

The bridge is zero-dependency Node, which meant writing the parts a dependency would have handed me. Apple Push over hand-rolled ES256 JWTs and HTTP/2 straight to Apple. TLS pinned to a SHA-256 certificate fingerprint that travels inside the pairing QR code itself, so the very first connection is verified rather than trusted.

On the phone: a WidgetKit widget and Live Activities, a slash command palette, voice dictation, a project file browser jailed to the working directory, git review, Siri intents, Bonjour discovery, and a French localisation of about 200 hand-written keys.

A pipeline of sanitize, detect, spotlight, harden, validate, with 70 detection signatures across 15 languages, noisy-OR scored, folding leetspeak and composed obfuscation.

ToolGuard is the part I would keep if I could keep one thing. It guards the three choke points of an agent loop: the arguments going in, with exfiltration URL heuristics, invisible Unicode smuggling checks and a scheme allowlist; the outputs coming back; and the loop itself, with rate limiting, duplicate call detection, and a taint model that refuses any call above read-only once the agent has read untrusted content.

Rampart, added in 0.5.0, is deterministic zero-dependency PII redaction for email, phone, card via Luhn, SSN, IP and IBAN, with typed placeholders and rehydration. It is a clean-room reimplementation rather than a port, for licence reasons.

The Swift implementation is complete and covered by 87 passing tests. The Python and TypeScript ports have the detection layer but not yet ToolGuard.

The EU's Chat Control derogation makes scanning private communications voluntary, so each provider decides for itself, and that decision, where it becomes public at all, becomes public as a small edit to a policy page. Nobody was keeping that record, and it is not a record you can reconstruct later. A measurement of 26 July can only be taken on 26 July.

So it is taken every day. At 06:17 UTC a zero-dependency tool fetches 96 tracked documents across 31 companies and 3 institutions, extracts the readable text, hashes it, and commits only when the text actually changed, so presentation churn never becomes a headline. Git history is the timestamped record, the repository is public so anyone can re-run it, and the Internet Archive is asked for an independent capture the same day. Alongside the policies it tracks 25 App Store privacy labels and 29 Play data safety declarations.

Most of the engineering is in not crying wolf. American CI runners were being served different pages than the European baselines, so every fetch now goes out through a relay in Paris. Google Play reshuffles its declarations on every request, so those are canonicalised before they are hashed. A failed fetch once got published as a policy change, so a capture that collapses to nothing can no longer overwrite a good one. When a record does turn out to be false it is withdrawn rather than deleted, and it keeps its page and its URL.

The site is 78 pages in five languages, generated by a script with no dependencies, and it ships no JavaScript at all except on the opt-in alerts page. It publishes observations and never conclusions: a recorded change means the document changed, and where the archive is silent it says so in those words, because silence measures disclosure and not behaviour.

The home page is not a page with animations on it. It is a seventeen-segment film across 3,400 viewport heights, with a CSS 3D MacBook whose lid opens on the hinge, a five-chapter iPhone act, and a canvas globe of 940 points drawing great circle arcs. Film grain, letterboxing and per-act colour grading throughout. Four locales, and untranslated routes noindex themselves rather than pretending.

The support portal has no accounts. Everything is email OTP and stateless HMAC tokens: the admin session, the fifteen-minute magic link, the per-ticket view key. It carries tickets, a public governance board, and translation across 20 languages, in 11 serverless functions, because the limit is 12.

The help assistant on every page has no model behind it. It fetches and indexes the site's own 28 pages in your browser and answers out of an IDF retrieval engine I wrote, with typo tolerance, light stemming, phrase bonuses and coverage weighting. No API key, no egress, no cost. A help widget should not be a data collection surface.