This only works if we build it together.
Oath Light is unpaid and open-source. It survives on people who care — writing code, correcting blocklists, testing rough builds, translating, or just telling a friend. You don't have to be a developer to help, and right now the most valuable work isn't code at all.
Three things would move this the furthest.
Taken straight off the project's own "what's left" list. Everything here is blocked on something other than someone being willing to write code.
A proper red team
Someone who did not write this code sitting down and genuinely trying to get past it, then writing down what worked. Read docs/HARDENING.md first so the attack lands on the real thing rather than the version you assume exists, then report holes in BYPASSES.md. The priority target is an administrator account — the known-weakest surface.
Model work & a real eval set
Quantising the ONNX ensemble, DirectML/NPU support with CPU fallback, and building a proper 200–400 image evaluation set. Today's accuracy numbers come from 30 images, which isn't enough to quote — and the Android port is waiting on the quantised model.
String extraction for translations
The locale layer is finished — key → locale → voice resolution, direction taken off the locale, CI failing the build on a translated placeholder. What's missing is that most UI copy is still hardcoded English. Extracting it is repetitive but it's the whole job; after that, a new language is one file.
Pick your level.
Write code
Improve the extension (plain JS, Manifest V3, no build step) or the desktop app (Rust / Tauri 2). Grab a good-first-issue and open a PR.
Improve the blocklists
Report a site that slipped through, or a false positive that shouldn't be blocked. Blocklist PRs are CI-checked against the allowlist floor and the adversarial suite.
Test & report bugs
The desktop pre-alpha needs real-world testing — especially the friction, the watchdog, the DNS takeover, and the Edge browser lock on a real machine.
Help with languages
The keyword engine spans 41 languages, and native speakers sharpen coverage in theirs. The Arabic UI draft also needs a fluent read in context before it ships as reviewed.
Docs, exercises & this site
Clear setup guides and honest explanations lower the barrier for everyone after you. The guided CBT/ACT exercises need the same care — five good ones beat thirty thin ones.
Star & share
Star the repo and tell someone who's struggling. Reach is how a free tool competes with funded ones.
The stack, at a glance.
Service worker, declarativeNetRequest rules, content scripts for per-item filtering, and a MAIN-world interceptor. No bundler, no npm, no build step — edit a file and reload.
The filtering DNS resolver, AI screen monitor, friction and guardian logic, the native-messaging bridge, and the recovery layer. Rust core, web UI.
One tokens.css and one strings.js shared by every surface, including this website. Visuals flow from the tokens, copy flows from the strings — nothing ships hardcoded per-surface.
The curated domain blacklist and the 41-language keyword sets that power detection, plus the allowlist floor the CI checks every blocklist PR against.
The one rule that governs everything: no false positives. A blocked legitimate site is worse than a missed porn site. Read CONTRIBUTING.md for setup and the test suites. Licensed GPLv3 — contributions stay free and open.
Straight answers.
Is Oath Light really free?+
Yes — GPLv3, with no paid subscriptions, premium tiers, locked features, or ads. There's nothing to buy, now or later, and no plan for there to be.
Does it send my browsing data anywhere?+
No. All filtering runs locally and there's no analytics of any kind. Exactly three outbound calls exist in the whole project, two of which don't happen unless you configure them — they're each named on the Privacy page.
Why is it so hard to switch off?+
Because a commitment made in a strong moment has to be binding in a weak one. Turning a protection on is instant; turning one off files a request with a 24-hour cool-off, and uninstall additionally requires typing a random 12-word phrase minted when you filed it. The core protections have no off switch at all.
Is the watchdog process a virus?+
No. Two cooperating processes watch each other and restore protection if one is closed. The behaviour is documented in the repo and the code is open-source, so you can verify exactly what it does. Antivirus tools sometimes flag the persistence — that's expected for a self-protecting app.
What browsers and systems are supported?+
The extension is published for Chromium browsers (Chrome, Edge, Brave) and Firefox. The desktop app targets Windows first, with macOS and Linux experimental and Android on the roadmap. Note that Edge can't be force-installed by policy on a consumer PC, so the app holds Edge shut until it's carrying the extension. See the Install page.
I'm not a coder — can I still help?+
Definitely, and the top of this page is proof: two of the three most valuable open tasks need testing and judgement rather than code. Report sites that slip through or false positives, test the pre-alpha and file bugs, improve docs, help with language coverage, or simply star and share the project.