Check the scope.
The security record documents AI-assisted reviews, including OpenAI Daybreak Blue. It identifies the code examined, the methods used and the limits of each review.
How Family Wishlist protects your privacy.
Your lists are stored in your Cloudflare account. You control who can sign in, and the app keeps buying plans hidden from the person receiving the gift.
- Who can sign in
- The organiser chooses which email addresses can sign in. Cloudflare Access sends a one-time code, and the app checks the sign-in before showing any family data.
- What stays a surprise
- Your own list never shows who is getting a gift or whether it has been bought. The server leaves that information out of your page entirely. Viewing links leave it out too.
- What you can inspect
- The source, architecture, tests and security report are public. The complete application is available under the MIT licence.
No advertising or behavioural tracking.
The app includes no advertising, behavioural tracking or analytics scripts. It does not insert affiliate identifiers into product links or earn a commission from what your family buys.
You choose the links you save. If you paste a URL that already includes a retailer’s tracking parameters, it may keep them. Opening a shop link takes you to that shop, where its own privacy practices apply.
Cloudflare processes technical information to host and protect your installation. Cloudflare Access also uses cookies to keep people signed in. These services still process data even though the app has no advertising or analytics scripts.
How this website handles privacyPublished security evidence
Read what was checked.
Security evidence lives with the application. These links follow the released project, so you can check its review history and changes in one place.
Follow the evidence.
Read the recorded findings, their fixes and follow-up checks. Dates and exact commits are kept in that record rather than copied into this website.
See what changed.
The latest release explains product changes, upgrade requirements and verification limits. Check it alongside the security record before updating your installation.
Read the latest release notesThe security record below follows the latest successfully promoted stable release. Each review covers only its stated commits or changes, not every future version. AI-assisted source review is not independent security certification or an audit of your live Cloudflare configuration.
Read the security review recordHow AI is used.
Jon Reed maintains Family Wishlist, with substantial AI assistance in development. Furls funded the development tooling. The repository includes automated tests, type checks, linting, dependency auditing and production build checks.
The app can also use AI to help read product details from a cleaned excerpt of a public shop page. It doesn’t receive your family lists or private gift claims, and it can’t save a wish.
The person running each installation is responsible for setting up access correctly, keeping the app updated and making backups. Code reviews and automated checks support that work.
Who maintains and supports the projectOpen source, end to end
Make the project yours.
Read the code, fork the repository and run it in your own Cloudflare account.
