I build the layer between you and the web.

Deciding whether a page is adult content is easy on a server and hard in a content script. The model has to load before the user notices, score text and images inside a frame budget, and share a process with whatever else the page is doing.

That constraint is the design. A larger model would be more accurate and would also mean sending the page somewhere, which is the one thing the product exists not to do. So it stays small, the blocklist carries the cases it can't, and the failure mode is chosen deliberately: a false block you can dismiss beats a miss you can't unsee.

Chrome, Edge, Firefox and Android are four review processes with four sets of opinions. Manifest V3's declarative rules are fast and are also a fixed budget you can exhaust; Firefox keeps more of the old flexibility but not all of it; Android has no extension model at all and had to become a local VPN service instead.

The answer was to push everything platform-specific to the edges — one blocking engine, one rule format, one settings model, and thin adapters per target. It is less elegant than a single build and it is the reason a fix lands everywhere in the same week.

Most software is built to obey immediately. A blocker installed by someone trying to stop something has the opposite requirement: it has to hold when the person who installed it wants it gone, ten minutes from now, at two in the morning.

In a browser that ceiling is low — a PIN over the settings raises the cost of quitting, and that is genuinely all an extension can do. Being honest about that limit is what made Warden a Windows service rather than a bigger feature list. Below the browser the lock can spend time instead of permissions: a delay on anything that loosens protection, which is the one measure an administrator cannot simply grant around.