Client-Side vs Cloud Checkers: Network Audit

Architectural Audit Takeaway: Moving verification from a vendor upload server into browser JavaScript ensures manuscript body paragraphs, raw .docx files, and bibliography text never hit a proprietary storage backend. Still, discrete title queries sent over HTTPS GET to public Crossref or OpenAlex REST APIs enter standard third-party access logs—meaning embargoed titles warrant DOI-only checks.

Why Architecture Matters More Than Privacy Badges

Traditional cloud citation checkers ask researchers to upload whole Word or PDF manuscripts onto remote servers before executing checks behind metered accounts or per-paper subscriptions. While convenient for commercial dashboards, uploading pre-publication clinical manuscripts, patent disclosures, or grant proposals creates unnecessary third-party retention risk when bibliographic validation only requires matching identifiers against public registries.

Rather than asking authors to trust vague confidentiality prose, verifiable privacy relies on inspectable client network behavior. Anyone can verify CitePure’s architecture in under two minutes using Chrome or Firefox Developer Tools (Network tab) or by inspecting our standalone offline unit runner.

Exact Outbound Network Inventory (Reproducible via DevTools)

Open DevTools → Network → filter by Fetch/XHR, paste a reference list into CitePure Verification Studio, and inspect every request emitted from the tab. You will observe strictly three categories of outbound traffic—and zero manuscript uploads:

1. Crossref DOI / Bibliographic Lookups (Public CORS JSON, no API key)
   GET https://api.crossref.org/works/{encoded_doi}?mailto=contact@citepure.com
   GET https://api.crossref.org/works?query.bibliographic={encoded_title}&rows=5&select=DOI,title,author,issued,container-title,volume,page,score&mailto=contact@citepure.com

2. OpenAlex Fallback / Non-DOI Search (Public CORS JSON, no API key)
   GET https://api.openalex.org/works/https://doi.org/{encoded_doi}?mailto=contact@citepure.com
   GET https://api.openalex.org/works?search={encoded_title}&per-page=5&mailto=contact@citepure.com

3. First-Party Cookie-Free Aggregate Counter (Single small JSON beacon)
   POST /blog/wp-json/citepure/v1/track
   Payload example: {"type":"tool_use","tool":"doi_checker","page":"/doi-checker/"}
   // Zero cookies, zero draft text, zero DOIs, zero queried titles, zero PII

Notice both registry APIs—documented in the Crossref REST API specification and OpenAlex Works documentation—natively enable Cross-Origin Resource Sharing (CORS). Your browser therefore connects directly from your machine to Crossref and OpenAlex without proxying bibliographic queries through CitePure’s web server.

Honest Threat-Model Disclosure: What Still Leaves Your Browser

Honest privacy engineering requires stating residual exposure clearly instead of claiming impossible “zero network trace” guarantees:

• Third-Party REST Logs on Public Searches: If a reference lacks a DOI, your browser sends an encoded search string (query.bibliographic=... / search=...) directly to Crossref and OpenAlex servers along with your network IP address and polite-pool header. Under their standard public API logging, short bibliographic query parameters are visible to those two scholarly registries.
• Practical Mitigation for Stealth / Embargoed R&D: Whenever a citation’s title itself contains sensitive keywords or confidential compound names, validate by identifier only inside the DOI Resolver (where only the opaque string 10.xxxx/... travels in the URL) rather than running keyword searches.
• Browser Local Storage Keys: CitePure writes zero tracking cookies and requires no login. Only lightweight UI state lives locally inside browser localStorage: Source Finder session history (citepure_claim_history_v1), local run counters (citepure_telemetry_v1), daily visit boolean (citepure_last_visit_day), and banner dismissal state (cl-announce-dismissed). All keys clear cleanly via standard browser site-data deletion.

Auditing Client Logic Offline Without Internet Access

Beyond DevTools inspection, engineering teams and institutional IT reviewers can verify that parsing, Unicode normalization, title similarity scoring, Chimera gates, and bracket reconciliation rely on zero external servers by inspecting our open Editorial & Privacy Architecture or testing deterministic inputs directly in the Verification Studio before granting access across lab workflows. Reviewing alternatives for team adoption? Compare workflows in our cloud checker architectural breakdown.