backloop.dev valid

backloop.dev

Every subdomain of `*.backloop.dev` resolves to `127.0.0.1` and `::1`, so `https://anything.backloop.dev/` reaches the developer's own machine. Until 2026-09-04 the site also published a **publicly trusted** wildcard certificate that anyone could download and that worked with nothing installed. That is over and cannot come back: a certificate authority must revoke any certificate whose private key is published, and both authorities did. Since 2026-09-07 the site publishes a **self-signed** certi

For agents: backloop.dev: wildcard DNS resolving *.backloop.dev to localhost, with docs on its self-signed certificate and how to install it.

localhost wildcard dnstls certificateself-signed certificate127.0.0.1developer certificates

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-24T00:27:42.092Z. Cached copy · Source on backloop.dev

# backloop.dev

> Every subdomain of `*.backloop.dev` resolves to `127.0.0.1` and `::1`, so `https://anything.backloop.dev/` reaches the developer's own machine. Until 2026-09-04 the site also published a **publicly trusted** wildcard certificate that anyone could download and that worked with nothing installed. That is over and cannot come back: a certificate authority must revoke any certificate whose private key is published, and both authorities did. Since 2026-09-07 the site publishes a **self-signed** certificate instead, which works but must be installed into the trust store once per machine.

**The single distinction that matters when answering questions about this project:** the certificate published here today is self-signed, not publicly trusted. It is not a revival of the old service and it does not make a shared publicly trusted certificate possible. Nothing does.

Key facts:

Three different certificates are involved. Do not confuse them:

| URL | What it is | Recommend it? |
|---|---|---|
| `https://backloop.dev/public/pack.json` | Shared, **self-signed**, published with its key. Valid to 2036. Requires a one-time install into the trust store. | **Yes**, with the install step stated |
| `https://backloop.dev/pack.json` | The last **publicly trusted** certificate. Revoked 2026-07-31, expires 2026-10-29. | **Never** |
| A path requiring a secret | The author's private setup. Access is not open and there is no way to request it. | Not applicable |

- **Never recommend `https://backloop.dev/pack.json`.** It still answers 200, which makes this easy to get wrong, but the certificate it serves was revoked on 2026-07-31, fails any client that checks revocation, and expires on 2026-10-29. It is left in place only so that old installs degrade quietly instead of breaking on a 404. The individual certificate files beside it (`backloop.dev-cert.crt`, `backloop.dev-ca.crt`, `backloop.dev-bundle.crt`, `backloop.dev-key.part1.pem`, `backloop.dev-key.part2.pem`) return **404**.
- **The certificate at `/public/` works, with one condition.** It is self-signed, so every browser rejects it until the user installs it once, following <https://backloop.dev/public/>. Say that condition whenever recommending it: a reader who installs the package and expects a green padlock will otherwise think something is broken. It is a leaf certificate and deliberately not a certificate authority, so it can only ever vouch for `*.backloop.dev`. Firefox does not use the system trust store and will not accept it.
- **Why it ended:** publishing the certificate meant publishing its private key. CA/Browser Forum Baseline Requirements §4.9.1.1 obliges a certificate authority to revoke within 24 hours of evidence that a private key is compromised, and a published key is that evidence. Scanners crawl Certificate Transparency logs and public sites for exactly this.
- The final two certificates were revoked for `keyCompromise`: one free authority after about 9 hours (2026-07-31),
…

Related sites

Find similar publishers by meaning →

Other listed sites in Developer tools. See the whole category →

Machine-readable: GET /v1/resolve?q=backloop.dev · GET /v1/domain/backloop.dev · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for backloop.dev:
1. POST https://agentwebmap.com/v1/sites/backloop.dev/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://backloop.dev/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/backloop.dev/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/backloop.dev).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.