A map you can check.

IntMap publishes every site its page can contact and what it sends to each — 113 sites, checked against the code on every change. In the map you can watch which of them your page has actually contacted, as it happens.

Open the map Report a security problem

What the page sends, and to how many sites

Grouped by what is sent, most personal first. The full list, site by site, is section 4 of the privacy policy. Privacy →

What you write or ask — sign-in, posts, questions to Atlas (IntMap's own backend)

1 sites — vpekfwdpurzejrrmacac.supabase.co

The first 5 characters of a password's hash (the password itself never leaves)

1 sites — api.pwnedpasswords.com

A web address — the article you asked to read

1 sites — r.jina.ai

Words — a place or topic you searched or opened

8 sites — *.wikipedia.org, api.gdeltproject.org, en.wikipedia.org, geocoding-api.open-meteo.com, news.google.com, nominatim.openstreetmap.org, photon.komoot.io, query.wikidata.org

A point — the coordinates of a place you chose

12 sites — air-quality-api.open-meteo.com, api.met.no, api.open-meteo.com, api.opentopodata.org, api.transitous.org, archive-api.open-meteo.com, earthquake.usgs.gov, maps.google.com, maps.googleapis.com, marine-api.open-meteo.com, mghydro.com, valhalla1.openstreetmap.de

The map area on screen — which tiles to draw

31 sites — *.basemaps.cartocdn.com, a.basemaps.cartocdn.com, a.tiles.openrailwaymap.org, api.mapbox.com, api.worldpop.org, b.basemaps.cartocdn.com, b.tiles.openrailwaymap.org, c.tiles.openrailwaymap.org, elevation-tiles-prod.s3.amazonaws.com, elevation-tiles-prod.s3.dualstack.us-east-1.amazonaws.com, elevation-tiles-prod.s3.us-east-1.amazonaws.com, gaez-services.fao.org, geo.vliz.be, gibs.earthdata.nasa.gov, mts*.google.com, overpass-api.de, overpass-api.openhistoricalmap.org, overpass.kumi.systems, overpass.private.coffee, s3.amazonaws.com, s3.dualstack.us-east-1.amazonaws.com, server.arcgisonline.com, services.arcgisonline.com, services.sentinel-hub.com, stream.aisstream.io, tilecache.rainviewer.com, tiles.maps.eox.at, tiles.openfreemap.org, tiles.openseamap.org, vtiles.openhistoricalmap.org, wmts.terrascope.be

An identifier — a country code, a flight or a satellite number

15 sites — api-v2.oec.world, api.planespotters.net, api.worldbank.org, celestrak.org, date.nager.at, flagcdn.com, geo.datav.aliyun.com, media.githubusercontent.com, ourworldindata.org, query1.finance.yahoo.com, stat.ripe.net, www.geoboundaries.org, www.google.com, www.imf.org, www.youtube-nocookie.com

That this page was visited

2 sites — fonts.googleapis.com, fonts.gstatic.com

Nothing about you or your map — a fixed request for public data

42 sites — api.alternative.me, api.coingecko.com, api.frankfurter.dev, api.fxratesapi.com, api.gold-api.com, api.ioda.inetintel.cc.gatech.edu, api.rainviewer.com, api.tfl.gov.uk, api.weather.bom.gov.au, api.weather.gc.ca, api.weather.gov, api.wheretheiss.at, api.wikimedia.org, apiprevmet3.inmet.gov.br, atlas.ripe.net, cdn.jsdelivr.net, cwwp2.dot.ca.gov, data.weather.gov.hk, davidmegginson.github.io, deepstatemap.live, fonts.openmaptiles.org, gisco-services.ec.europa.eu, hacker-news.firebaseio.com, ll.thespacedevs.com, maps.dwd.de, mapservices.weather.noaa.gov, mempool.space, open.er-api.com, openmeteo.s3.amazonaws.com, raw.githubusercontent.com, services.arcgis.com, services.swpc.noaa.gov, tie.digitraffic.fi, unpkg.com, upload.wikimedia.org, volcano.si.edu, volcanoes.usgs.gov, weathercam.digitraffic.fi, www.jma.go.jp, www.nmc.cn, www.submarinecablemap.com, www.who.int

See it for yourself

  1. Open the list

    In the map, open Settings, then Privacy, then This page's connections. Every site your page has contacted since it opened is there, as your own browser reports it.

  2. Compare it with what IntMap says

    Each site is shown beside what IntMap says it is sent. A site IntMap does not name, or one it says it never contacts, is shown first and marked.

  3. Keep the record

    Download the list as a file. It is made in your browser and is not sent to us. You can also ask Atlas: «Who is this page talking to?»

How the page protects you

No third-party analytics

No analytics or session-recording service is loaded. IntMap counts anonymous usage itself, and you can turn that off in Settings.

No script runs unless it is listed

The page's security policy runs only scripts from IntMap's own site, a short list of named sources, and inline code whose exact bytes are listed. A script injected into the page is refused by your browser.

Said plainly: the 3-D globe needs eval

The policy still allows code to be compiled from text (unsafe-eval) because the 3-D engine IntMap uses requires it. It is recorded as an accepted risk, and a test turns red on the day the engine no longer needs it.

Passwords are checked without being sent

When you choose a password, it is checked against known leaks by sending only the first 5 characters of its hash; the comparison happens in your browser.

Libraries are checked against known vulnerabilities

Every week and on every change, the libraries sent to your browser are checked against the public database of security advisories, and a change whose package list contradicts the libraries it installs is refused.

Your data is yours to see and take

Signed in, Account then Your data lists everything the account holds and downloads a complete copy. Deleting the account deletes all of it.

Report a security problem

Please report privately, through the form — not in a public issue. Choose «A security problem». Only IntMap's administrators read it, and we answer by e-mail. There is no bug bounty, and we do not promise a response time: nothing measures one yet.

Report a security problem

Worth reporting

  • Script injection (XSS) in the map, its pages or the admin console
  • Reading or changing another person's data, or getting around sign-in or the AI allowance
  • A real secret exposed in the code or the site
  • A site the page contacts that IntMap does not name

Not a vulnerability

  • The publishable database key in the page — it is public by design; access is enforced by the database's row-level rules
  • Response headers the static host cannot set (for example X-Frame-Options); the in-page policy stands in for them
  • The rate limits or costs of the public data services IntMap reads

Questions

Why does the page contact so many sites?

Most are the public data services a layer draws from — weather, earthquakes, flights — and are contacted only when that layer is on. Each one's group above says what it is sent; for many, that is only the map area or nothing at all.

Where is the full technical description?

The threat model, the data flows and the risks IntMap has accepted are published with the source code (docs/SECURITY-ARCHITECTURE.md and SECURITY.md).