LYNX
An independent, privacy-focused web search engine — no query logs, explainable ranking, and crawler ethics as a structural constraint.
An independent, privacy-focused web search engine — no query logs, explainable ranking, and crawler ethics as a structural constraint.
Overview
An independent, privacy-focused web search engine — no query logs, explainable ranking, and crawler ethics as a structural constraint.
Threats Modelled
35
T01–T35, with residual risk
Architecture Decisions
21
Numbered ADRs
Documented
114K
Words of design spec
Status
Design
Phase 0 in progress
Get the build
Signed release artefacts, reproducibly built from the tagged source tree.
| Artefact | Target | Version | Size |
|---|---|---|---|
| anoneurx/lynx | Rust + TypeScript | main | source |
| specification.md | Reference spec | v0.1 | docs |
| PRIVACY.md | Privacy commitments | v0.1 | docs |
Capabilities
Privacy is structural
The query is parsed into an AST at the handler boundary and the raw string is dropped. There is nothing for a logger to log.
Explainable ranking
Every served result carries its full per-signal breakdown. score(doc) = f(doc_id, index_generation, ranking_config_version, query), so any past ranking can be recomputed.
Rotating-salt rate limits
HMAC-SHA256 over a daily salt and the first three octets of your IP. Memory-only counters, 25h TTL, no durable identifier to correlate across days.
SSRF gate, re-checked per hop
Ten-step validation before every socket and again at every redirect, with DNS pinning and IPv6-embedding unwrapping. A deny list that misses those is decoration.
No JavaScript, ever
No headless browser, no cookies, no shell. Only extracted text is stored — never raw HTML — which shrinks both the copyright and the XSS surface.
First-party only
A CSP with no unsafe-inline and no third-party origin anywhere, plus a build-time test that fails if the bundle contains an off-origin URL.
People behind the project
Contributors
Testers & QA
Nobody listed yet — this project is looking for its first contributors.