Verify a Source

How it works

When a source enters the platform, a database trigger computes SHA-256(url + "\n" + raw_content) and writes the result into the sources.content_hash column with a timestamp. The trigger fires inside the database engine, not the application — so even a compromised app can't insert mis-hashed rows.

Every fact on the platform points at its source row, and every source row carries its hash. That means:

• You can verify whether a published fact rests on a source whose content has remained immutable since ingest.
• You can cross-reference our hash against an external mirror (the Internet Archive's Wayback Machine, your own copy of the source URL) to detect tampering on either side.
• If a source's content_hash ever changes without an explicit correction notice, that is detectable from a single byte comparison — and we publish the daily Merkle root that binds every day's hashes together.

Where to get a hash

Hashes are exposed on every fact's PROVE IT audit bundle and in the daily attestation at /attestation (when published). You can also compute the hash yourself from any source URL — if your computation matches ours, the source is intact; if it differs, somebody changed something.

What this page reveals

If you provide a hash that matches a source we've cited, this page tells you what source it is, when it was first hashed, and what facts and findings depend on it. If you provide a hash we don't have, the page returns "no match" — which is informative on its own: either the hash is wrong, or the source was never cited on this platform.

This page does not let you enumerate sources by guessing hashes. SHA-256 is a 256-bit space; reverse-lookups are computationally infeasible.