关于本站 (About this site)

技术栈 (Tech Stacks)#

前端 (Frontend)：Astro 7 + TypeScript

后端 (Backend)：

• Cloudflare Workers
• Astro Actions
• Cloudflare D1 + KV
• GitHub OAuth, Cloudflare Turnstile, Resend…

信息 (Info)#

本博客很大程度借鉴了 https://antfu.me 的设计，感谢托尼老师的创意和付出。本站不接入第三方跟踪器，不出售、共享或外传访问数据。

This site draws heavily on the design of https://antfu.me, Thanks a lot for his creativity and works. We do not use third-party trackers, and we do not sell, share, or export visitor data.

隐私策略 (Privacy)#

本站使用一套自托管的第一方访问计数器，用于展示站点和文章的 PV / UV。它只记录聚合后的访问量，不记录任何隐私信息。

计数器的实现方式：

• 浏览器端生成一个随机访客 ID，并保存在本站域名下的localStorage中；
• 服务端会将该 ID 与私有盐值一起哈希后再写入 Cloudflare KV；
• KV 中只保存计数值和匿名哈希标记，不保存明文 IP、User-Agent 或原始访客 ID；
• UV 标记会自动过期；
• 明确发送DNT: 1的请求不会被计数；
• Sec-GPC: 1 会被视为“不出售/共享个人数据”的信号。由于本站统计为第一方聚合计数，且不出售或共享数据，因此仍会进行匿名计数。

本站仅在登录、评论等交互功能中使用安全配置的 Cookie 来保存用户状态。

评论需要一个可辨认的身份，因此使用 GitHub OAuth 登录：只会读取你的公开资料（昵称、头像、站点）以及已验证的主邮箱（仅在有人回复你时用来发提醒），不会读取仓库或其它权限；会话是一枚 httpOnly、30 天有效期的 Cookie，不在前端缓存你的身份。

This site uses a self-hosted first-party counter to display site and post PV / UV. It only records aggregated counts and does not support profiling, advertising, or cross-site tracking.

How the counter works:

• The browser generates a random visitor ID and stores it in localStorage under this site’s domain;
• The server hashes that ID with a private salt before writing anything to Cloudflare KV;
• KV stores only counters and anonymous hash markers, not raw IP addresses, User-Agent strings, or the original visitor ID;
• UV markers expire automatically;
• Requests with explicit DNT: 1 are not counted;
• Sec-GPC: 1 is treated as a “do not sell/share personal data” signal. Since this is a first-party aggregated counter and no data is sold or shared, anonymous counting is still performed.

Securely configured cookies are only used for interactive features such as login and comments.

Commenting requires a recognizable identity, so sign-in goes through GitHub OAuth: only your public profile (login, avatar, website) and your verified primary email (used solely to notify you about replies) are read — never your repositories. The session is a 30-day httpOnly cookie, and your identity is not cached in the frontend.

安全 (Security)#

如果你发现了本站的任何漏洞（XSS, CSRF…），请报告给 mailto:i@nickchen.top，我会最及时地响应你。

If you discover any vulnerabilities on this site (XSS, CSRF…), please report them to mailto:i@nickchen.top. I will respond to you as promptly as possible.

本文采用 CC BY-NC-SA 4.0 许可，转载请注明出处。