Methodology

Our methods depend on the question. A provider’s published policy can establish what that provider says. A parser run can establish what one API version returned for one input. A browser check can establish how our tool behaved in a named configuration. None of those, alone, proves the others, and none of them shows whether a site is safe.

The URL inspector

The inspector uses the browser’s own URL parser and a pinned snapshot of the Public Suffix List, both its ICANN and private sections, shipped inside the page under the list’s Mozilla Public License. It never updates the list or fetches anything. We check it with recorded cases covering user information, IP-address hosts, internationalized names, wildcard and exception suffix rules, private suffixes, malformed labels and Clear. During those actions the page’s Resource Timing record shows zero requests. That is a page-level observation, not a packet capture, and it does not cover browser extensions or other software on your device.

Provider policy comparison

Each service’s terms, privacy notice and documentation were read without submitting anything. Every statement is recorded with its source type, the date checked and a short quotation in the source ledger. A field the sources do not address is unknown, which is different from “no”. Pages that could not be retrieved are marked as unavailable rather than guessed.

Parser matrix

Original fixtures use reserved example names and documentation addresses. They are run through declared command-line parsing APIs with exact runtime versions and no network access. Native outputs and errors are kept as returned. Agreement between parsers is not a safety signal, and disagreement is not a vulnerability.

Reporting-route directory

The directory lists official entry points only. They were read, not used: no report, appeal or message was sent. Where two routes lead to the same authority, for example Firefox’s phishing-removal route using Google’s form, the data says so.

What we publish

Compilations and observations are CC BY 4.0, and original code is MIT licensed. Each asset’s METHOD file, hash list and source ledger are published with it. Provider text, the Public Suffix List and runtime software keep their own licences.