Why the private beta

4got is in a private beta. This page explains why and what that means for you.

The short version

I built this in my free time and I don’t want to expose early testers to security vulnerabilities that haven’t been found yet. A search engine handles sensitive data by nature — your queries reveal what you’re thinking about, what you’re worried about, what you’re researching. I’d rather bring in a small number of people at a time, find the obvious holes, and fix them before opening the doors to everyone.

The longer version

This project started as a personal itch. I wanted a search engine that didn’t suck, didn’t track me, and didn’t require a data center to run. I ralph’d it together in my free time — evenings, weekends, whenever I had the energy. It’s not backed by a company, it’s not funded, and there’s no team. It’s just me and a mass of Claude Code subagents.

That means my bandwidth for handling bug reports, security disclosures, and feature requests is limited. Open-sourcing a security-sensitive application before it’s ready invites problems I can’t respond to fast enough. A private beta lets me control the pace:

• Bring in a few people. They use it for real. They find bugs I missed.
• Fix everything they find. No new testers until the current batch is stable.
• Repeat. Each wave finds fewer issues. The software converges toward something I’m comfortable putting my name on.

This is the same approach Mitchell Hashimoto used for Ghostty, and for similar reasons — not to manufacture hype or exclusivity, but to match the rate of incoming problems to the rate at which one person can fix them.

What this is not

This is not a “sign up for the waitlist and we’ll get back to you” situation. If you know me, ask me. If you don’t know me but you’re genuinely interested, join the community and make yourself known. I’m not trying to be gatekeepy — I just need to be able to sleep at night knowing I’m not serving search results through code that hasn’t been properly reviewed.

When will it be public?

When we’re confident in three things:

1. Security. The code has been audited enough that I’m not losing sleep over someone’s queries leaking, their session getting hijacked, or the server getting popped through the image proxy or AI research agent.
2. Direction. The architecture is settled enough that early adopters aren’t going to hit breaking changes every week. The federation protocol, the engine spec, the config format — these need to be stable before other people build on top of them.
3. Obvious bugs. The kind of stuff that makes you look stupid. Engines that silently return zero results. Oracles that give wrong answers. Cache corruption. The stuff that’s embarrassing in hindsight but invisible when you’re the only person testing.

The code will be released under AGPL-3.0. There’s no open-core play, no commercial license, no bait-and-switch. The private beta is purely a quality gate.

How to get access

Access to the beta is via mTLS client certificates — see Friend Access for the technical details. In practice: I generate a certificate for you, hand it to you (preferably in person), and your browser uses it to authenticate. No accounts, no passwords, no third-party identity provider.

If you want in, reach out. I’m not hard to find.