Privacy and security

The Ceplin Command Identifier reads your command in your browser. There is no server side to it: this site only hands out files, the same files to everyone, and what you paste never leaves the page.

What happens when the page opens, and when you press Identify

1. Once the page has loaded, it starts a Web Worker, a background thread of this browser tab, and a panel in the corner shows its progress. The worker downloads the identifier from this site: engine.wasm, Ceplin's identify() compiled to WebAssembly, and wasm_exec.js, Go's loader for it.
2. Beside it comes the main index, data/binaries.dat. The other indexes in data/ are downloaded the first time a command needs one, such as the AWS index for an aws command. They are the same files for everyone, and asking for one says nothing about your command.
3. When you press Identify, your command is handed to the engine inside the browser, in memory. The engine looks it up in the indexes and hands back the report, and the page draws it.

Your browser caches these files like any other site's, so a later visit starts sooner. If you have asked your browser to save data, nothing is downloaded until you click into the command box.

What never happens

• Your command is not sent anywhere. No request carries it, to this site or to any other.
• No other site is contacted: no analytics, no advertising, no fonts or scripts from elsewhere. URLs and addresses found in a command are shown defanged and are never looked up.
• No cookies, no accounts, no tracking.
• No AI writes any result. Every description is quoted from published documentation, and every verdict is a public Sigma rule.

What is stored

• Your choice of light or dark, in this browser's local storage, under ceplin-theme. Nothing else.
• Your command is not stored, and it never goes into the address bar, so it is not in your browser history. Close or reload the tab and it is gone.
• When an Identify link or the try box on a program page opens the identifier, the command waits for it in this tab's session storage under ceplin-identify, and the identifier removes it as soon as it reads it.
• The downloaded files sit in your browser's cache. They hold nothing about you.

Reports

Report an issue writes the report on the page, shows exactly what it holds, and opens it in your own mail app. Nothing leaves until you press send there. The command goes in only if you tick the box.

Why WebAssembly is safe here

WebAssembly runs in the same sandbox as the JavaScript on any web page. It cannot read your files, see your other tabs or reach anything the page itself could not. The engine has one way out of that sandbox: asking for its own data files, which come from this site.

The page also carries a Content Security Policy. It tells your browser to refuse any connection to another site, and any script that did not come from this one. So even a mistake in the page could not send your command elsewhere: the browser would block it.

What the host sees

The server that hands out the files sees what any web server sees: your IP address, your browser, and which of the files above were downloaded. It never sees your command.

Check it yourself

• Open your browser's developer tools, choose the Network tab, and identify a command. Every request goes to this site, and none carries your command.
• Identify one command, then go offline. Further commands still work in that tab, as long as they need no index it has not downloaded yet.