← spaghetti

Your browser talks directly to GitHub.

Spaghetti is a static website. Cloudflare serves its HTML, CSS and JavaScript. There are no application servers, Cloudflare Functions, databases, analytics or third-party scripts in this deployment.

Your token is sent only to api.github.com, in the Authorization header. Repository searches and pull-request requests also go directly there. The site’s Content Security Policy permits JavaScript connections only to that GitHub API origin.

The token stays in this tab’s session storage so reloading works. “Forget token” removes it. Session storage is still accessible to this site’s JavaScript and may be restored by your browser; it is not a secure vault. Never paste your token into an issue, chat or shared board.

Boards and cached PR details are saved in localStorage, separately for each GitHub account. They remain after forgetting the token. Clear this site’s browser data to remove them. Revoking GitHub access cannot erase previously saved local copies. Browser storage can be cleared or run out of space; use the share button to keep a copy of important boards.

Shared strings contain repository names, PR numbers, board names, tags and dependencies. They contain no tokens or PR snapshots, but are not encrypted. Share them only through an appropriate channel.

For a classic token accessing private repositories, GitHub requires the broad repo scope. Spaghetti only reads data, but that scope can also grant writes. Authorize the token for your organization’s SSO in GitHub settings. Fine-grained tokens can restrict repositories and permissions; the PR query must also be allowed to read its review and check information.

GitHub token settings · SSO instructions

To check the data path:

  1. Open Developer Tools → Network, clear the list, then connect or refresh. Data requests should go only to api.github.com. The Spaghetti domain serves static files.
  2. Edit a board, then export or import its share string. Those actions do not upload the board. An import may fetch missing PR details directly from GitHub.
  3. Inspect Application/Storage to see the local board and tab token. Do not share an unredacted network capture: it can contain the token.
  4. Review the source and the build manifest. The manifest records SHA-256 hashes of published files and the source revision when available. Cloudflare’s deployment details separately indicate whether Functions are used.

This establishes the application’s design and observable requests, not a universal proof of non-retention. Cloudflare handles ordinary requests for site files and may retain infrastructure metadata. GitHub handles API requests. You still trust the JavaScript served by this domain, your browser and its extensions.