Crawler and bot policy
Which automated clients are allowed, which are challenged, which are blocked, and why the site does not use User-Agent as a security boundary.
API reference
The public HTTP API behind the site: endpoints, versioning, rate limits, authentication and error format. Machine-readable schema at /openapi.json.
Base URL and versioning
The API is served from https://api.cognitive-industries.org. Every endpoint is available at both an unversioned path and a versioned one — /api/live and /api/v1/live are the same endpoint. New clients should use the versioned form; the unversioned paths remain for existing callers.
A version is only retired after it has been announced on the changelog page and served a deprecation header for at least ninety days.
Public read endpoints
GET /api/v1/live — current working status and recent history.
GET /api/v1/leaderboard — the public bounty debt board.
GET /api/v1/donations — top donors.
GET /api/v1/views — the site view counter.
All are unauthenticated, CORS-enabled, cached at the edge, and paginated where a list can grow, with a hard maximum page size.
Public write endpoints
POST /api/v1/contact — a contact message.
POST /api/v1/recruit — a recruitment application.
POST /api/v1/bounty — a bounty submission.
Writes require Content-Type: application/json, a body under the size limit, and a Turnstile token once Turnstile is configured. Every field is length-validated and type-validated server-side before it reaches the database.
Authentication
Human sessions use HiveMind single sign-on over OIDC with PKCE, and a signed, HttpOnly, SameSite session cookie minted by the API. There is no password to steal because the API never sees one.
Machine clients use a bearer token scoped to a single capability. The work monitor token can write live status and can do nothing else. Tokens are stored as Cloudflare Worker secrets, never in the repository, and are rotated by issuing the new token, deploying, then revoking the old one.
Errors and limits
Errors are JSON: {"error": "...", "request_id": "..."}. The message is deliberately generic — no SQL, no table names, no upstream text — and the request_id is what to quote when reporting a problem. Server-side logs carry the detail.
Rate limits return 429 with Retry-After. Request bodies are capped; oversized bodies return 413. Unsupported methods return 405 with an Allow header.
Sources
Where this page states a standard, an obligation or a research result, this is what it is drawn from. All external, all checkable.
- RFC 9116 — A File Format to Aid in Security Vulnerability Disclosure — the security.txt standard
- Schema.org vocabulary — the structured-data vocabulary every page here uses
- Google Search Central: structured data — Google
Other documents
Security practices
How this site and the systems behind it are secured: headers, transport, secrets, dependencies, monitoring and disclosure.
Brand and entity reference
The canonical name, description, logo, domains and social handles. Use these verbatim in directories, articles and structured data.
Last reviewed · Site changelog