I'm working on putting the source on github but you'll just have to take my word for it at the moment.

However even with the source, there's no guarantee that the site is running the same code, so it's a bit of an empty gesture on my part. Bear in mind that the DB is now starting to do the rounds publicly so if people want to phish you with fake password reset emails, they will whether my site exists or not.

Technical info HN may appreciate: the back-end uses a redis-backed murmur3 bloom filter. The front-end is written in clojure (http-kit + compojure + hiccup) and hosted on heroku (behind cloudflare).

I had thought about that myself, but this is only leaking email address. I publish publicly anyway. It's not asking for CCN, or any other "secret" data.

I agree.