Bulgar DNA

BULGAR DNA — five minute review

What changed

Website capture now refuses to fetch anything on the private network — the version on main would happily fetch 127.0.0.1 or a cloud metadata endpoint, which is a real vulnerability and is why main must not be what you review. Work in progress now survives navigating away.

The path

1. Start a new brand.
2. Enter a website — any real public site.
3. Capture — watch what it found, and where each thing came from.
4. Evidence — every claim should carry its source. A claim with no source should show no value rather than a guess.
5. A conflict, if one appears — it should show you *both* answers and ask, not pick one quietly.
6. Questions — answer a few.
7. Identity — check the source chips: "you told us" versus "from your site".
8. Blueprint — unknowns should be named. There should be no percentage anywhere that was not counted from something real.
9. Leave and come back — navigate to Blueprint mid-way, then return. Your answers should still be there. This is the fix; it is worth testing hardest.
10. On your phone — the questions step and the review screen.

What I verified on this exact preview

Driven in a real browser against a local database, today:

• website capture returns real findings, each with a certainty label and the mechanism it came from ("your page title, up to the first dash")
• a hostile URL is refused through the UI. 169.254.169.254/latest/meta-data/ comes back as "That does not look like a web address", and nothing is fetched
• answers survive leaving. Answered down to 14 remaining, left via the header Blueprint link, returned to 14 remaining. That link used to discard the walkthrough silently, so it is the thing worth testing hardest
• /blueprint renders

Known mobile roughness, recorded for the design pipeline rather than fixed now: the questions screen has 41 tap targets under 44px. No horizontal scroll anywhere.

Deliberately partial — do not read these as finished

Instagram: not implemented. No Meta app, no token, no provider. It reports NOT_CONNECTED and shows nothing. Nothing about it is faked. Connecting it needs either a Meta App Review or a paid scraper account — a decision, not code.

Smart questions: partial. They are gated by evidence but the wording is fixed and there are no follow-ups. Measured honestly: a full scan of a rich site removed zero of the 16 questions asked. The mechanism is real; the depth is not there yet.

The new visual direction: not started. The colourful, editorial direction was deliberately not applied — the repository's current design law says warm cream and green, and the two conflict. That conflict is yours to settle, through the design pipeline, after you have judged whether the product works.