brandrune/brandrune.com

The site for Brandrune, the free Claude
Code naming skill. A Cloudflare Worker with static assets, on its own custom
domains (brandrune.com and www.brandrune.com, no wildcard route).
- public/: the home page (index.html, home.css, app.js), the shared
style.css, the OG image, the brand guide at /brand/, the sample results pages
under /sample/, the replay data at /demo/run.json, and /confirmed/.
- src/worker.js: serves the assets with security headers, redirects www and
http to https://brandrune.com, and handles the double opt-in signup
(POST /api/subscribe, GET /confirm, POST /api/confirm).
- demo-run/: the recorded run the home page replays (an invented plant-care app,
150 names on .com and .ai, checked 2026-10-10). build.py turns its
results.json into public/demo/run.json using the skill's own status labels:
python3 demo-run/build.py /path/to/skills/brandrune/scripts/brandrune.py. The
skill's HTML page from the same run is public/sample/plant-care/index.html.
test/static.test.js fails if the page's printed tallies or picks drift from the data.
- sample-run/: the invented project, names and registry results behind
public/sample/. Regenerate with the skill's script:
python3 brandrune.py check sample-run/names.txt --tlds com,ai --description-file sample-run/about.txt --out sample-run/results.json --html public/sample/index.html
- brand-src/: the logo system as code. geometry.py builds the carved
berkanan mark and the drawn wordmark from one 30 degree construction;
build.py writes every SVG into public/brand/assets/ (plus
public/favicon.svg); render.mjs renders the PNGs, public/og.png and
public/apple-touch-icon.png with headless Chromium.
Brand assets
The SVGs carry no and no live text in the logo itself, so they
render the same everywhere and pass the site CSP when opened directly. The
social card template keeps its headline as live text on purpose, so it can
be edited.
The .com checker
The "Is yourname.com open?" box on the home page asks Verisign's RDAP server
straight from the browser (Verisign sends Access-Control-Allow-Origin: *, and the
request uses only a CORS-safelisted Accept header, so there is no preflight). The
site never sees the name. It applies the skill's rules for one extension and no
price check: a 404 only counts when it is served as application/rdap+json,
redirects are not answers, and a "no record" is only trusted after nic.com or
google.com comes back registered. A trusted no-record shows as open*. The CSP
allows connect-src https://rdap.verisign.com and nothing else off-site. The
parking list in app.js is copied from brandrune.py 0.3.0; keep them in step.
Email signup (double opt-in)
1. POST /api/subscribe checks the Origin (SITE_ORIGIN), rate limits per IP
(SUBSCRIBE_LIMITER, 5 a minute), refuses a body over 2 KB by Content-Length
before reading it (and cuts off an undeclared one at the cap), validates the
address, and treats a filled honeypot field as success. Then it emails a
confirmation link from CONFIRM_FROM. **Nothing is written to the Resend
audience at this step.**
2. Sends are capped three ways, all counted against the address with its +tag