Verify the code

Scumhouse’s privacy claims rest on JavaScript that runs in your browser and holds keys the server never sees. That is only worth anything if you can tell which JavaScript you got.

What this proves, and what it doesn't

These hashes are also written into every game page as integrity="sha384-…" attributes, so your browser refuses to run a script whose bytes do not match. That stops tampering with the deployed file on its own.

It does not stop someone who edits the manifest too. For that, the check has to happen somewhere the operator does not control:

1. Compare the hashes above against public/integrity.json in the published repository, whose history shows every time they changed.
2. Or check it yourself, from your own machine:

   git clone https://github.com/kkoechel/scumhouse.git
   cd scumhouse
   tools/monitor-integrity.sh https://boarddames.com/scumhouse

   A silent swap then has to survive somebody else’s computer.

An operator can always ship bad code. The point of all this is that they cannot ship it quietly.