Open source
What we open-source — and why.
The brand promise is "we hide nothing." The most-loaded code in our system is the publisher embed (tag.js) — the 3KB of JavaScript every page we monetize executes. We treat that surface as public for the same reason cryptography algorithms are public: anyone should be able to audit how it works.
tag.js — embed code
The publisher tag.
The exact JavaScript that fires impression pixels, enforces viewability + tab-focus checks, and decides when to refresh a slot. No minification, no obfuscation, no hidden behavior. Pull it down, diff it against /tag.js on our domain, and verify they’re the same byte-for-byte.
- No cookies set, ever. No first-party, no third-party.
- Viewability gate: IntersectionObserver ≥50% for 1s + document.hasFocus() + visibility=visible before firing the imp pixel.
- Rate limit: 30s minimum between refills, 20 fills max per session per slot.
- No fingerprinting beyond the IP + UA the receiving server sees anyway.
Other public surfaces
- /api/openapi.json — OpenAPI 3.1 spec for the ad-server.
- /sellers.json — IAB sellers.json.
- /blocklist.txt — Real-time creative + URL blocklist.
- /methodology — SiteScan scoring formula.
What we don’t open-source
The dashboard, the auction engine, the SiteScan internals beyond the methodology, and the fraud heuristics stay closed. Three reasons:
- Fraud surface. Open-sourcing the invalid-traffic scoring is publishing the attacker playbook. We publish the policy (the action ladder on /methodology), not the heuristics.
- Business logic. Auction internals + pricing optimizer are the platform we charge for. Open core, paid intelligence.
- Operational security. The dashboard touches PII (account info, payout details). Open-sourcing the auth + audit code without scrutiny is worse than a closed-source equivalent.
Contributing
The GitHub repo for tag.jsgoes live with our public launch. Issues + PRs welcome there once it’s up. In the interim, send tag.js feedback to [email protected].