I came at this from the breaking side. Working out how to get into something is what teaches you where it leaks, and most of what I put up here is that pointed back the other way: here is what you are giving away without knowing, and here is what you can actually do about it.

Small tools. One binary each, nothing to install.

• Birthmark: whether the photos you are about to publish carry your camera's mark, which no metadata tool touches
• Accent: what ties your anonymous code to you
• Tell: what the way you write gives away
• Lineup: how many people you could still be, from what an account has said about itself

• Airing: what your repository releases when it goes public
• Alibi: what your commit history publishes about you
• Baggage: what is inside a file before you send it
• Pentimento: whether what you cropped, covered or blurred out of a file is really gone
• Kerbside: what your dist folder publishes the second you deploy it
• Toolmarks: what the binary you are about to publish says about you
• Dunnage: what your container image is still carrying
• Workings: what your notebook publishes
• Outtakes: what a terminal recording kept that you did not mean to publish

• Verbatim: what your coding agents wrote down
• Hearsay: the forty files on your machine that write down what you type
• Glasshouse: what your computer says about you, and how much of it you can change
• Haunts: what the networks your computer remembers say about where you have been
• Doormat: the keys you have left lying about
• Ajar: which doors your own ssh folder leaves open

• Customs: what an installer can do to you, before you run it
• Tally: what an archive will do when you unpack it
• Waxwork: what a model file does when you load it
• Tidemark: what something left behind after it ran

• Fal: a programming language in Spanish, with a course that marks its own exercises
• Unpick: build a cipher out of the usual pieces and watch the oldest attacks take it apart
• Octavo: turn a PDF into a booklet you can print, fold and staple

Nothing leaves your machine. No uploads, no lookups, no telemetry. Not as a promise either: there is no network code in any of it, and a test reads the source and fails the build if any turns up.

Your file stays your file. Nothing overwrites what you pointed it at.

It tells you what it could not read. A short report is not a clean result. A tool that quietly gives up is worse than no tool, because it hands you confidence you have not earned.

No dependencies if I can help it. Usually that means writing the boring part myself instead of pulling in somebody else's.

Go most of the time. Rust when it earns its place. Whatever fits the job, really.

Spain.