SSD · Shield of Self-Defense
OCF's digital-security curriculum for Taiwanese civil-society organizations: 94 pages of localized security guidance, policy templates — and, hidden inside, a full 7,600-line Three.js 3D teaching game.
The seven dimensions
memoryTechnical Depth 7.5/10
Far above average for a docs site: a custom MkDocs build hook does content-hash cache-busting for ES modules (with idempotency and stable hash ordering), 12 theme overrides plus 1,820 lines of custom CSS, and 8 plugins including llms.txt generation for AI consumption. The embedded 3D game brings procedural terrain, InstancedMesh vegetation, a post-processing pipeline, device-tiered quality, Web Audio synthesis and a three-language structure-text-separated i18n architecture — fully vendored, fully offline.
stadia_controllerContent & Pedagogy 8.5/10
Professionally engineered pedagogy: written editorial rules target a junior-high reading level and mandate 'concrete steps, never concepts alone' with counter-example contrast; a standard chapter template specifies time / budget / protection level per lesson. Content is technically correct and current (Passkey/FIDO2 anti-phishing explained properly; the VPN comparison cites third-party audits) and the 8-chapter NGO security-policy template maps onto actual Taiwanese nonprofit governance. The consultant toolkit is thin and leans on a non-public Google Docs deck.
securityBackend & Security 7/10
No backend — but deployment security practices walk the talk: a Tor onion service with onion-location headers on every page, the privacy plugin self-hosting third-party assets, CVE-aware dependency bumps in CI, minimal-scope Cloudflare purge tokens, and an XSS-escaping helper in the game that even got a fix for unescaped single quotes. The one glaring contradiction: a privacy-education site ships Google Analytics.
codeCode Quality 7/10
Well-organized configuration with commented decisions, a docstring-ed cache-bust hook, visible refactoring discipline in the game code (a dedicated dedupe/dead-code commit produced util.js), consistent frontmatter. Legacy debt shows: the asserts/ (sic) directory typo permeates the site, personal-security content is split across two directory trees, and the game's main.js is 3,755 lines with no linter anywhere.
experimentTesting 2.5/10
The weakest dimension: the only workflow builds and deploys on push — no PR CI, no linkcheck, no markdown lint, and MkDocs strict mode is off, so broken links warn instead of failing. The hook and 7,600 lines of game JS have zero tests. Build success is the only quality gate for a 94-page curriculum.
verifiedCompleteness 8/10
All 8 advertised topics landed as 94 markdown pages (~260k characters — roughly a 250-page book), plus an 11-post blog series, checklists, the policy template, a trilingual game, issue templates, contribution guides and licensing docs. Live and tied to real-world events (a forum sign-up on the site). Maintenance is bursty: ~10 commits in the year to 2025-11, then 116 in June 2026.
emoji_objectsOriginality 8.5/10
Not a translation compilation of EFF SSD / Security-in-a-Box, but an original localized rewrite: LINE web-login 2FA, hijacked Facebook pages, NT$ budget ranges, Taiwan VPN node comparisons, a Signal/email incident-reporting channel, and governance-aware policy templates. Sources are honestly credited. And 'teach security via a 3D adventure game' — five ruins as five courses, wrong answers as learning moments — is a genuinely rare pedagogical move in this space.
trending_upHighlights
- An embedded Three.js teaching game — 7,600 lines, trilingual, fully offline, with turn-based quiz combat and five skill-practice stations (
docs/games/) - Content-hash cache-bust hook — solves real mixed-version ES-module deploys, with idempotency and stable hash ordering (
hooks/cache_bust.py) - Tor onion +
onion-location— a security curriculum that practices what it preaches on anonymous access (overrides/main.html) - A ready-to-adopt NGO security-policy template — 8 chapters mapped to Taiwanese nonprofit governance (
docs/org/policy/template.md) - Editorial rules as code — audience-fit turned into executable writing constraints, plus
llms.txtfor AI consumers (contexts/writting_rules.md)
trending_downWeaknesses
- Nearly no CI quality checks — no PR CI, no linkcheck/lint, strict mode off; 94 pages of links verified by hand
- Privacy contradiction — Google Analytics on a privacy-education site (
mkdocs.yml:239-241) - Thin consultant toolkit relying on a permission-gated Google Docs deck, with placeholder text left in (
docs/guide/assessment.md) - Information-architecture debt — split directory trees and the site-wide
asserts/typo - Opaque attribution — 87% of commits from a shared org account; individual contributions untraceable
A different species: the organizational project
Where craig7351's games are one person + one AI at maximum velocity, ssd is infrastructure: a shared account, PR reviews, issue templates, an upstream-sync branch model, bot deployments and scoped tokens. Slower, but built to outlive any individual contributor.
The trade shows in the scores: ssd wins originality and content design by a wide margin and is the only project with real institutional continuity — yet its testing gap (no CI checks for a 94-page curriculum) mirrors the same industry-wide blind spot the games have.
smart_toyAI-assisted development
Different in kind from craig7351's repos: an organization-operated project — 139 of 160 commits from the shared ssd@ocf.tw account, an OCF staff member, three external contributors, PR flow with issue references since 2026, deploy-branch strategy and secrets management. The June 2026 burst of 116 commits (mostly the game) suggests a single, likely AI-assisted development pipeline arriving late in the project's life.
summarizeFacts
| Stack | MkDocs Material · Python 3.11 + uv · Three.js 0.184 · GitHub Actions · Cloudflare · Tor onion |
|---|---|
| Genre | Security curriculum + 3D teaching game |
| Period | 2024-09-23 → 2026-07-16 |
| Active dev days | 660 days |
| Commits | 160 |
| Lines of code | ~7,600 |
| Author | Open Culture Foundation (OCF) |
Verdict
The highest total score in the audit: original localized content with professional pedagogy, deployment security that practices what it teaches, and a surprise 3D game inside. Its gaps — no CI, a GA tracker on a privacy site — are fixable process debts, not design flaws.