Item level, crawled nightly
crawl 3 days agoSearch the index
75,944 items985 registries34,217 verified free11,020 verified paid30,707 unverified18,895 previewable live11,371 removed in 30 daysrebuilt 2026-09-13 · captured 2026-09-13

Security

what it stores and how to report a vulnerability

Every item in every public shadcn registry, re-crawled and re-counted every night.

Reporting a vulnerability

Email hello@thecompound.tech. Include the URL, what you did and what you saw. There is no bounty and no NDA to sign. We confirm receipt, and we tell you what we changed.

The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.

Accounts

BlockDex has no user accounts. There is nothing to sign in to, no password to reset and no session to steal. A build gate fails the deploy if an authentication route ever appears while this page still says otherwise.

What is stored

An email address, only if you type one into the subscribe form, and only after you confirm it by clicking a link.

Anonymous page analytics with the IP address truncated before it is stored.

Who else processes data

ProcessorWhat it does
Vercelhosting and edge delivery; request logsSupabasethe database this product's own index is served fromPostHogproduct analytics, IP-truncatedResenddelivering the one email the subscribe form sends

Each processor links to its own privacy policy.

Also true

Everything on this site is generated from public sources and rendered as static pages; there is no user-generated content that another visitor can see.

The whole estate runs on one Supabase project with row-level security on; this product's tables are its own.

Who runs it

BlockDex is built and run by Compound Labs. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe.