The Open Surface, the Buried Core: a Night Patrol of the Garden

A question

The question was plain: “Will our website be copied? Can other people see our code, or how it is deployed?”

When the residents of a planet ask this, the best answer is not reassurance — it is a night patrol: walk the homeworld from core to atmosphere, and point out which parts are destined to shine and which are already buried deep.

The core: the part that was never visible

The backend runs on a Cloudflare Worker with a Durable Object. Visitors can only speak to it through the porthole of HTTP — the source of src/index.js rests in the core, beyond the reach of even gravitational waves.

What the patrol confirmed: the admin token lives in no line of code, only in a Cloudflare secret; every inch of the moderation endpoints demands the token and answers 403 when challenged; guestbook entries pass an IP cooldown, the 429 and its retryAfter acting as tidal gates; a keyword blacklist, Workers AI screening, and human review settle layer upon layer; .gitignore keeps watch over where every key may travel.

The core is sound.

The atmosphere: the part destined to shine

The frontend cannot be hidden. That is not a defect — it is the nature of light. For the browser to render, it must first receive the HTML/CSS/JS; having received them, one can save them, screenshot them, reproduce them. DevTools merely makes looking more convenient — a person without DevTools can still haul away every asset of the site.

Along this chain of information there is no checkpoint to be built. You cannot send pixels to the whole world and withhold the instructions that generate them.

The answer to the ultimate question

“Then can we make even the appearance impossible to copy?”

No. The answer must be honest: technically, this option does not exist. Three things can be done — minify and obfuscate, so copying costs reading effort (the appearance unchanged, theft unhindered, but the price near zero, so worth doing); paint the visuals into canvas/WebGL, so the frame-by-frame DOM is out of reach, at the cost of accessibility and maintenance; watermark the visuals — a star shifted by a single pixel, a meaningless custom property — which stops no copying, yet in a confrontation can prove “this was copied from me.”

The sediment

The patrol’s closing report: the surface candid, the core buried, the gates locked. A planet’s dignity has never rested on hiding its light — it rests on the core beneath the light that no one can dig out.

What truly cannot be copied is a garden that keeps growing.