Build log · day 3
Building in public, one commit at a time.
Every entry below comes from our commit history and decision notes, with the source next to it. Times are Montevideo time (UYT). What isn't done yet is listed first, so nobody mistakes it for done.
Nextnot done yet
Company registration
Kernel Init isn't registered yet. We'll log it here when it is.
posture.kernelinit.com
Posture is built. Its public home on its own subdomain is next.
Product 02
Unnamed until it's real.
Day 3Mon 2 Nov 2026
Result pages kept out of search, security.txt
Shared result and compare links now ask search engines not to index them, so a scan never turns into a search page about someone else's business. A security.txt points to our contact page, and the privacy copy says exactly what is and isn't kept. Built and tested locally; live after the next deploy.
Kernel Trust v3 is live
kernelinit.com/trust is deployed with all five parts, store readiness included.
Kernel Trust v3: store readiness
A sixth check for shops, reported as its own red/yellow/green verdict: refund, shipping, privacy and terms pages, real contact details, business identity, brand consistency and product data, read the way a payment or Merchant Center reviewer might. Homepage plus at most 15 fixed public paths, no crawling. A self-check heuristic, not what any processor uses, and it doesn't change the Trust score. Built and tested locally.
Kernel Trust v2 built
Five scored modules instead of four: email identity, web transport, outside scripts, domain & DNS, and a new AI visibility check. A live scan log, a fix-first list with copy-paste snippets, a compare page, share cards and an embeddable badge. Built and tested locally; still nothing stored.
Kernel Trust MVP built
A free external check at /trust/: email spoofing, third-party scripts, security headers and lookalike domains, scored 0–100 with a public rubric. No install, no login, nothing stored.
This build log
The site gets this log, share cards and a feed. You're reading it.
The brand lands on every page
The whole site moves to the new brand system.
Day 2Sun 1 Nov 2026
The [▮] mark
Brand system v0.1: a cursor between brackets, Init Green, three typefaces, light and dark.
16 research pages
10 countries, 5 categories and a hub, generated from aggregate-only data. A segment needs at least 30 scanned stores to get a page.
State of Shopify Security
The report gets its own page and a PDF. Aggregates only.
kernelinit.com: first commit
The company site starts as a static build: no framework, no trackers.
Critical findings: 54 → 3
Two rounds hunting false positives across all 1,676 stores. Fewer alarms, more trust.
53 risk checks
A risk module with 53 checks lands in Posture.
1,676 stores scored
A stratified sample of live Shopify stores, scanned passively: public pages, DNS and TLS only.
Everything becomes Posture
Separate experiments merge into one product with one engine and a 0–100 Store Trust Score.
Day 1Sat 31 Oct 2026
A market benchmark, aggregates only
First passive benchmark across real stores. Rule from day one: publish aggregates, never name a store.
Monitoring and reports
Ongoing monitoring (what becomes Watch and Guard), white-label reports and an OpenAPI spec.
First commit of the scanner
Passive collectors, DNS over HTTPS, an SSRF guard and explainable scoring. The engine that becomes Posture.
Day 0date not recorded
The name comes first
kernelinit.com was already ours. A company with a name and a plan, and no product yet.
Start with a free snapshot.
One domain in. A 0–100 score and your top findings out, each with evidence. Passive, no app install.