Review the source.
OpenAI Daybreak Blue examined identity, family access, claim secrecy, outbound fetches, browser security, data rules and the build pipeline.
How Family Wishlist protects your privacy.
Your family gets its own space, in its own Cloudflare account. The code and the engineering decisions are open for anyone to inspect.
- Who can sign in
- The organiser invites exact email addresses. Cloudflare Access handles one-time PIN sign-in, and the app checks the signed identity again.
- What stays a surprise
- Gift claims and purchase state are absent from the owner’s server response. Read-only sharing also leaves out every claim.
- What you can inspect
- The source, architecture, tests and security report are public. The complete application is available under the MIT licence.
No advertising or behavioural tracking.
The app includes no advertising, behavioural tracking or analytics scripts. It does not insert affiliate identifiers into product links or earn a commission from what your family buys.
You choose the links you save. If you paste a URL that already includes a retailer’s tracking parameters, it may keep them. Opening a shop link takes you to that shop, where its own privacy practices apply.
Cloudflare still processes the technical information needed to host and protect an installation. Cloudflare Access uses authentication cookies to keep people signed in. “No tracking” here means no advertising or behavioural tracking by the app, rather than no infrastructure processing.
How this brochure website handles privacyDaybreak Blue · 1 September 2026
An open record of the security review.
An AI-assisted adversarial source review, with the findings and fixes preserved in public.
Fix the findings.
The original review identified five actionable findings. The maintainer fixed them, added checks, and addressed a further issue found during re-review.
Publish the evidence.
The final review on 1 September 2026 found no remaining actionable findings in the reviewed source at commit ad9571c.
The report records an AI-assisted source review of a specific commit. It is not an independent security certification or a review of every future change. Live Cloudflare configuration was outside its scope.
Read the full security reportAI assistance and human maintenance.
Jon Reed maintains Family Wishlist, with substantial AI assistance in development. Furls funded the development tooling. The repository includes automated tests, type checks, linting, dependency auditing and production build checks.
The app’s optional AI feature has a narrower job: help recover product details from a cleaned excerpt of a public shop page. It doesn’t receive your family lists or private gift claims, and it can’t save a wish.
Source-led review and automated checks are part of ongoing maintenance. Each family’s operator still needs to configure access correctly, keep the application updated and look after backups.
Read about stewardship and supportKeep the next good idea.
Give your family’s wishes a place of their own.