IndieGardenBot

If you saw IndieGardenBot/1.0 (+https://indiegarden.codeaz.org/bot) in your logs, that was us, reading a public changelog so a plant in the garden could grow.

What it reads

• Public changelog feeds (RSS, Atom, JSON Feed) and changelog pages
• Public GitHub releases and tags through the GitHub API
• App Store and Google Play version notes, npm, PyPI and crates.io version lists
• Your sitemap, to notice new pages (the URL and date only)
• One HEAD request a day to your home page, to know the site is up

It stores the title, date and a short excerpt of each update, and nothing else. It never logs in, never fills in forms, and never reads anything behind authentication.

Private repositories

If a maker connects a private repo through our GitHub App, the garden stores how many commits landed on each day and nothing more. No commit messages, file names, diffs or code are ever stored.

How politely

• It honours robots.txt. Disallow IndieGardenBot and it stays out.
• It sends at most one request a minute to your site, and never more than two at once.
• It checks your changelog every six hours if you shipped this week, and once a day otherwise. If your server errors, it backs off for longer and longer.

Opting out

Opt-outs are a hard block that every crawler checks before it fetches anything. Two ways:

• Remove your plant. You verify with a meta tag, a DNS record, or an email to the contact in your security.txt. No account needed, and the plant is gone within six hours.
• Or block IndieGardenBot in robots.txt.