Cribado

Self-hosted sieves for the reports your systems send back.

A browser that blocks something reports it; a mail server that rejects something reports it. Cribado is a family of small self-hosted tools that sieve those report streams — store, deduplicate, surface what actually changed. Cribado-CSP watches Content-Security-Policy violations; Cribado-DMARC, on its way, watches DMARC aggregate reports.

Cribado-CSP Cribado-DMARC

🤖 This page was written by an LLM, on the ideas, instruction, and editing of humans. AI-written text here is always marked, visibly, like this — that's factor X.

Modern infrastructure reports on itself, and almost nobody listens. Browsers will POST a report every time a Content-Security-Policy blocks something; mail receivers mail you XML about every message claiming to come from your domain. The hosted services that listen are metered per report, and the raw streams are firehoses of noise — so the feedback channels stay dark. Cribado is the listener you run yourself. The family name is cribado — Spanish for sieving, the work of a criba — because that is the whole idea: a sieve for the report stream, keeping the grain and shedding the noise.

The premise in one line: a report stream is a dedup problem, not a logging problem. A policy misfiring a thousand times a minute is one fact with a big counter, not a thousand rows. Store the fact once, count it, and watch the counters for the handful of changes that mean something.

One idea, several streams

Every reporting protocol deserves the same sieve.

Cribado-CSP

The CSP-violation sieve. One endpoint accepts both browser report formats, deduplicates them into counted rows, and turns the counters into deterministic warnings — a new blocked host, a spiking directive, a real enforce-mode breakage. v1, in progress: ingest and dashboard run today.

Read about Cribado-CSP →

Cribado-DMARC

The DMARC aggregate-report sieve, on its way. Receivers mail zipped XML about who sends as your domain, straight to the binary's own inbound SMTP listener; Cribado-DMARC unpacks, parses and deduplicates it into plain warnings — a new source sending as you, mail failing authentication, a policy safe to tighten. Deployed; the production mail path is the current work.

Read about Cribado-DMARC →

The trade-off, stated plainly

Cribado's operators can read every report it stores. On purpose.

Cribado is built on CARLOS, whose family rule is server-blindness: the server holds only ciphertext it cannot open. Cribado deviates, deliberately, because the product is analytics over the reports — you cannot cheaply compute aggregates over data you cannot read. These reports are operational telemetry about your own systems, closer to a server log than to a private message. The family rule for deviations applies instead: enumerated, justified, published, never hidden. No end-to-end encryption is claimed, here or anywhere. Each app's page states its own version of the trade-off, alongside what it still refuses to store.

Part of a family

One binary, one SQLite database, no build step.

Cribado apps are CARLOS applications, built with the Rastrillo web framework: each a single static Go binary with the database compiled in, deployed as one instance, small enough for one person to read. This site follows the same rule — static pages, no build step, no dependencies, no JavaScript.

The source is not yet published; the licence is being decided before first publication, and open source is the family default — not optional, only deferred. When that changes, these pages will link to it.