Moving visuals on this page — measured at 0.26% brightness change per frame and zero flashes per second; your reduce motion setting stops them. What moves, and how it was measured
Mathematical plates that draw themselves — prime counts, orbits and lattices rendered live rather than shipped as pictures. It runs continuously while
on screen, and it pauses on its own whenever it scrolls out of view.
We measured it rather than guessing: the largest frame-to-frame change in
average brightness is 0.26%, and it produces
zero flashes per second against the threshold of three set by
WCAG 2.3.1.
That is well under the limit, and it is not a promise about any individual: if
moving images are a problem for you, you should not have to assess ours.
Everything animated on this site honours your system’s
reduce motion setting — turn it on in your operating
system or browser and these pages stop moving, with nothing else lost. All the
mathematics is in the text and the still figures.
Public API
What this account holds.
The public compute API closed on 7 August 2026 and no new keys are issued. This page stays open for the keys that already exist: paste any client code from your account and it lists every key on it and what state each is in. None of them computes anything any more — the endpoints return 403 before a key is read — but you are still entitled to see what is recorded against yours and to have it erased, and a lookup you cannot perform is not much of an entitlement.
It does not list the keys themselves. It cannot: we store the SHA-256 of each key and nothing else, so there is nothing here to hand back. That is deliberate and it is the reason a leak of our registry would not hand anyone a working credential.
Look it up
What do I hold?
Why three, and why one budget
Extra keys buy isolation, not headroom
The three keys existed so you could separate your own uses — a notebook, a class demo, a script you were not sure about — and revoke one without breaking the other two. They drew on one shared allowance of three calls a day. Since 7 August 2026 that allowance is nil for all of them: revoking still works and is still worth doing, but nothing here can be spent.
That is worth stating plainly because it used to be false here. Every key used to carry its own daily counter, so anybody who filled the form twice had six calls a day rather than three, without cheating and without anyone noticing. The counter now hangs off the applicant instead of the key. There was a route to more than three calls — a short exam and an email to a person — and it closed with everything else on 7 August 2026. There is no higher tier to ask for and no address to ask at.
Revoking a key does not use up one of your three slots. Otherwise reporting a leaked key would cost you a slot permanently, which would quietly encourage people to keep a compromised key instead of telling us about it.
We set no cookies of our own beyond what the site needs to work, and we run no advertising and no cross-site tracking. Our network provider measures page performance at the edge without cookies and without anything we can tie to a person; we get aggregate numbers, never a visitor. It also runs bot protection there, which is a security control and stays.
Cookies & local storage — the exact list, not a summary
Nothing here is hidden behind a settings toggle that doesn't actually do anything: if it's not in this table, we don't set it.
Name
Type
Set by
Purpose
Duration
ksec_theme
localStorage
This site
Remembers your light/dark mode choice
Until you clear it
ksec_cookie_ack_v1
localStorage
This site
Remembers you've seen this notice
Until you clear it
ksec_cookie_choice
localStorage
This site
Remembers whether you accepted or rejected, so we do not ask again
Until you clear it
ksec_build_notice_v1
localStorage
This site
Remembers that you collapsed the build notice in the corner
Until you clear it
ksec_notice_rev_v1
localStorage
This site
The site revision you last loaded, so a page left open across a deploy can tell you it is stale
Until you clear it
ksec_catalog_seen
localStorage
This site
How many entries the shared catalogue had the last time you looked at it, so the nav can tell you when it has grown and stay quiet when it has not. One number. It says nothing about you — only about how much of a public list you have already seen
Until you clear it
ksec_findings_seen
localStorage
This site
The measurements of Life objects this browser has already sent to the shared catalogue, so it does not send the same one twice. A short list of numbers such as p6:d0-0:n14 — period, displacement, population. It describes what the background drew, not you, and it never leaves your browser: what goes to the catalogue is the pattern itself, and the server measures it there
Until you clear it
ksec_notebook
localStorage
This site
The mascot’s research notebook on /mascot: the claims it tested in this browser, the seed, and the verdict, at most 40 entries. Never sent anywhere.
Until you clear it (there is a button on the page)
ksec_last_visit
localStorage
This site
When you were last here, so the mascot can tell you the site was rebuilt while you were away — and stay quiet when it was not. A timestamp, nothing else, and it never leaves your browser
Until you clear it
ksec_tool_uses_…
localStorage
This site
A per-tool daily-use counter for the free tools, one key per tool (a fair-use nudge, not an enforced limit, never sent anywhere) — set only if you actually use one of those tools
Resets daily; until you clear it
__cf_bm and similar
HTTP cookie
Cloudflare, Inc. (our security & CDN provider)
Distinguishes legitimate traffic from automated abuse — the same security gate described in Methodology
Session, typically under 30 minutes
That's the whole list. We don't set analytics, advertising, or tracking cookies of any kind — Accept and Reject in the banner currently do the same thing on this site specifically because there's no non-essential cookie for Reject to actually disable. That's not us dodging the question: under PECR/LSSI-CE, strictly necessary cookies (all we set) are exempt from consent entirely. We show both buttons anyway, and record which one you pressed, because that's the clearer and more honest thing to do even where it isn't strictly required. Full legal detail in Privacy & Cookie Policy.