He posted a rebuttal and rewrote the list.

On 8 October 2026 Alex Gleason posted armadaexposed.exposed and called it his rebuttal. The page shortens this site's "What holds up" list, announces that the product works, and leaves his own sentences off the page.

The public site is one HTML document, a stylesheet, a favicon, robots.txt, and a sitemap with that single URL. Requests for /about, /faq, /people, /ledger, /claims, /sources, and /app.js returned 404. The HTML contains no script element. The line at the bottom, "This page: 0 scripts. 0 trackers. 0 localStorage," matches the document. The words appear in the sentences. The page does not call them.

Who posted it

RDAP for armadaexposed.exposed, fetched 9 October 2026 from Identity Digital: registered 8 October 2026 at 20:21:34 UTC, last changed the same minute, expiration 8 October 2027, registrar NameCheap, Inc., nameservers dns1.registrar-servers.com and dns2.registrar-servers.com, status "add period" and "client transfer prohibited." The registrant fields are redacted. The record does not print his name.

At 23:11:34 UTC the same day, Reddit account gleasonator13, flair "Armada dev," the account on the 7 October reply, posted "armada.exposed: exposed" in r/DiscordAlternatives:

Hi all! In response to armada.exposed, I would like to share my rebuttal: https://armadaexposed.exposed/ Please take a look.

The page itself says, "Who made this site? The crew behind Armada. Unlike some sites, we'll tell you." The crew, on that page, has no names. The media kit still names Alex Gleason, M. K. Fain, and Derek Ross. The about page adds Chad Curtis. None of those four names appear on the rebuttal.

The armada.buzz homepage he is defending carries <meta name="build" content="2026-10-08 23:06:31Z">. That stamp is five minutes before the Reddit post. The privacy-policy chunk in that build says "Last updated: October 8, 2026." The policy edit was already in the build he then linked.

"Their own verdict"

The rebuttal says this site has a section called "What holds up" and that it says:

Then: "So… the product works."

The section on the home page says this:

He deleted Concord, NIP-04, the website push path, the author count, the bounty limit, and the ledger. The six lines that remain are the ones that fit on a stamp. "The product works" is his sentence. It is not the verdict on this site.

The same page then sells the product again, under the concessions. "Encrypted communities. Relays only ever see sealed envelopes." "End-to-end encrypted calls and screen share for the whole squad." "Discord import." A reader who stopped at "So… the product works" never sees that two cards higher he had already written "Correct" about NIP-29, and "It's Discord" about the bridge.

The charges, in his words

Each row is a headline he wrote, the reply under it, and the record. Quotes are from the page as fetched 9 October 2026.

His chargeHis replyRecord
"The web app stores your key in localStorage!" "That's how websites work. On your device. Like the terms say. Like every web client. Android, iOS and desktop use the OS keystore." The terms in TermsPage-S3Zzfkkn.js, still "Last updated: August 28, 2026," say a secret key "is never sent to the developers or to any server." They also say the app stores it on the device. The web path is localStorage.setItem. The 8 October index bundle still contains that call. Desktop encrypts when the OS store works and writes plaintext when it does not. Android uses the system keystore. The iOS app he names is the one the self-host guide says does not exist yet. On 7 October the same origin also loaded the npanel scripts. Those tags are gone in the 8 October HTML. Any script on the origin can still read the key. His reply describes the terms' promise about his servers. It leaves out the desktop fallback and the cleartext web store.
"A public ledger shows grant money paid the developers!" "They found our transparency report. That's what a grant is. It's public because we put it there." The expenses are public. Through 9 September 2026 the AOS fund had paid $1,048,130.79 to the Open Collective organization soapbox.pub. Gleason has been an admin of that organization since he created it on 11 August 2021. The legal-name field is empty. All 294 of those payments used one bank payout whose holder the public page does not name. Two more expenses, $3,100 and $1,200, were paid to him by name. He filed both. On 7 October he wrote, "I didn't take any money from the nonprofit either." The rebuttal does not mention that sentence, those two rows, the blank legal name, or the admin role. Jack Dorsey's Start Small grant was $10,000,000 into the fund. The fund then paid the organization. The rebuttal's "grant pays developers" ticker is the joke version of the row he does not open.
"Out of the box, it uses Soapbox's servers!" "They found the self-hosting guide. Their source is our guide on how to swap them out. Settings → change them." The guide does tell you to change them. platform-CIK08raQ.js in the 8 October build, when RELAYS is unset, still falls back to wss://relay.ditto.pub and wss://relay.dreamith.to. Voice defaults to https://armada.buzz. The bridge default is https://bridge.armada.buzz. Blossom fallbacks are still blossom.ditto.pub, blossom.dreamith.to, and blossom.primal.net. The policy updated the same night says Soapbox operates relay.ditto.pub, blossom.ditto.pub, the link-preview service at ditto.pub, and the voice broker at armada.buzz. A setting that can be changed is still a default. His own FAQ on this page says the defaults "are just where a brand-new install starts," and the next FAQ says your messages never pass through them.
"The Discord bridge isn't end-to-end encrypted!" "They read the warning label. It's Discord. The app says so and makes you tick a box first." The wizard does say that, and the claims table already says so. The warning is the disclosure inside the import. M. K. Fain's comparison essay, 30 July 2026, still says Armada encrypts every community end to end, and the same essay sells the bridge. Ticking the box tells the person who imports a server. It does not rewrite the essay. The rebuttal's own product strip still lists "Discord import" under the sealed-envelope line.
"NIP-29 groups aren't end-to-end encrypted!" "Correct. Armada uses Concord, which is. NIP-29 is someone else's relay-hosted protocol that Armada can also open." He concedes the mode. Concord chat and Concord voice match the slogan. NIP-29 does not. The voice code calls NIP-29 calls "no media E2EE (relay-trusted SFU)." Buzz, which Fain's essay sells, is a NIP-29 relay: the operator holds the room. "Someone else's protocol that Armada can also open" is a feature the client ships, next to Concord, from Chad Curtis's first commit on 12 June 2026. The marketing sentence is "every community." His reply is "the default kind." Those are different sentences, and he wrote the second one only after this site quoted the first.
"The hosted site had Plausible analytics!" "Deleted. You're welcome. Ripped out entirely. Privacy policy updated. Thanks for the bug report." The script tags are gone. See Fair cop. "Ripped out entirely" describes the homepage HTML. The policy dated the same day still says the hosting gateway collects a crash report with "a short trail of recent clicks, page changes and network requests." The file that did that on 7 October, /_npanel/errors.js, is not in the 8 October document, and the URL 404s. He fixed the tag and left the policy describing the tag.
"Soapbox Technology, LLC exists!" "They found the LLC on the LLC paperwork. App stores need someone to sign the paperwork. The protocol is still owned by nobody." Soapbox Technology, LLC, Watertown, South Dakota, is the name on USPTO serial 99824668, filed 14 May 2026, on the Play listing, and on the AGPL section 7 permission for the stores. The soapbox.pub homepage says the tools are "owned by no company. Not even ours." Concord is an open protocol with a public spec. The trademark, the store account, and the Open Collective payee are paperwork with a payee. The rebuttal mentions the signature and skips the mark, the $3,420.30 trademark expense filed the same day as the application, and the sentence on their own homepage.
"A community owner can remove you!" "Moderation ≠ ban. From their community. Nobody can delete your key from everywhere. Not even us." This site already says that. No company can delete a key it did not issue. Fain's Henhouse post, 17 June 2024, is the other half she already published: they cannot stop you speaking on the open protocol, and they can revoke the identity on their relay. The essay line is "A platform-wide ban is technically impossible." His reply answers a global deletion. The default relays in the 8 October bundle include relay.ditto.pub, which the new policy says Soapbox operates. A relay can refuse the events. That refusal is the ban that fits on one server, and it is the one the slogan drops.
"The relay knows when you connect!" "Your relay can see you use your relay. It still can't read anything. Google and Apple don't get to know at all. Don't like it? Run your own." "Can't read anything" is true of Concord ciphertext and false of the rest of the product. A NIP-29 relay holds the room. NIP-29 voice has no media end-to-end encryption. The Discord bridge copies channel text in the clear. Link previews in the 8 October bundle go to https://api.ditto.pub/link-preview/{url}, and the client comment says that proxy sees every previewed URL. Ross's guide says to leave AUTH_KINDS alone, because the default makes a client identify itself before it can ask for community messages. The identifier is the account key, from an IP. Google and Apple are a different sentence. Android notifications are a socket to the relays, which this site already grants. The website's push path is a nostr-push2 gateway plus the browser vendor's push service. The new policy says that gateway "matches encrypted events and never sees message text." It still sees that a key has a subscription.
"Downloading a file shows the server your IP!" "The internet uses IP addresses. It downloads ciphertext it can't open. Want more? Turn on the media proxy, or use…" The sentence on the page ends at "or use…". It does not name the other option. Concord attachments are encrypted before upload, so the blob is ciphertext, and the fetch still comes from the viewer's IP. He concedes the media proxy by telling you to turn it on. It is off until you do. AGENTS.md says an image in a message learns the IP of everyone who scrolls past it unless that proxy is on. NIP-29 uploads are the other case: the file server can serve the file. The 8 October policy still says "Uploaded files are generally publicly accessible via their URLs," and in the same policy the file-upload section says those servers "are operated by third parties" while the overview says Soapbox operates blossom.ditto.pub.
"The server sends an Onion-Location header!" "We offer Tor. To the Tor people. Yes." He agrees. The 8 October response for armada.buzz still sends Onion-Location for armadahvhvaj57ojv7mavkqaecdajzejansfiksp5mdscczyh5g7stid.onion. The essays and the rebuttal's own buttons link https://armada.buzz/. The header is an offer to Tor Browser. The site opens on clearnet. His page sends a different onion, csal2jj7muj7j34xk7hwa2ornu2hykipt64n6tmnd4tmmtrz4gtxzzqd.onion, and the same joke is the whole answer.
"No email? Then why is there an iPhone waitlist?" "Newsletter ≠ account. It's a "tell me when it launches" box. Optional. Your account is a key." The box is optional, and creating an account does not ask for an email. That half holds. The self-host guide, fetched again 9 October 2026, still ends with the form and the sentences "Get notified when Armada comes to iOS" and "There is no iPhone app yet. Drop your email and we will tell you the day it ships." The charge was the word "no email" next to a form that asks for one. His reply renames the form. The form is still there.
"The changelog lists security fixes! There's a bug bounty!" "Exposed: bugs got fixed. That's what secure software looks like from the outside." The bugs were fixed. This site says so. Changelog 0.55.2, 19 August 2026, says sharing into Armada "now accepts only genuine shared content, closing a path by which another app could have had Armada read its own private files, including your decrypted message history." Fain's essay says the first bounty was $1,000 in June 2026 for a role-revocation flaw fixed the same day. The essays also say nobody can read your messages. The changelog is where the client had already been able to. A fix is a fix. It is also a record that the slogan had a hole, and his reply treats the hole as a compliment.
"Discover shows the team's picks first!" "Curated list is curated. The front page of the app has… the app team's picks. Stop the presses." He agrees, in the same voice as the onion line. The Discover copy in the 7 October bundle called one of those picks "An encrypted community that runs without a server." Curation is the team's hand on the front page. The "no company" essays are the claim that hand is not there.
"The guide says 'no asterisk on the calls,' then lists caveats!" "Read the next sentence. About invite links. Not calls." The next sentence is not about invite links. After "with no asterisk on the calls," the guide's next paragraph is: "Or you stop after the frontend, point it at relays from nostr.watch, and get most of that for an afternoon of work and no database to babysit. That is the honest recommendation for most communities." Then a paragraph about the official Android app. Then "Two caveats on that." The first box is invite links, and it is about links: the installed app only claims armada.buzz, and "on iOS the app does not claim links at all yet." The second box is OpenSearch, a hand-written relay service, and a voice certificate. Earlier, the guide says "ditto-relay ships no Dockerfile and no compose file," and the voice broker "is an open service by design" because "anyone who finds yours can use it." The claims table had grouped those as the next sentences. That label was wrong. His label is wrong too. The asterisk sentence is still in the guide.

Fair cop

His page has a box titled "Fair cop":

Then: "See? That's how you take feedback."

Checked against the build stamped 2026-10-08 23:06:31Z:

The removal of the two script tags is real. u/henk717, who on 8 October wrote that he is not otherwise involved with Armada or Soapbox, posted peqpi08 at 23:22 UTC the same night: "Glad the tracker is now deactivated properly, hope that new users can also soon enjoy a better default relay selection thats more varied out of the box." The relay half of that hope is unmet. The fallbacks above are the 8 October defaults.

The new policy's file-upload section still says Blossom servers "are operated by third parties" and that uploaded files "are generally publicly accessible via their URLs." The overview in the same file says Soapbox operates blossom.ditto.pub. The bridge at bridge.armada.buzz is not in the list of servers the policy names. Direct messages are described as NIP-04 or NIP-44, with sender, recipient, and timestamps visible, and Concord communities as CORD-02. Voice: Concord media is end-to-end encrypted, and "For NIP-29 servers, the relay operator manages the LiveKit instance and its data handling, and calls are encrypted only in transit." That paragraph is more precise than the rebuttal's "End-to-end encrypted calls and screen share for the whole squad."

The rendered name in those quotes is the platform fallback Armada, used when window.ENV does not set APP_NAME. The 8 October homepage does not set window.ENV.

Lines the rebuttal adds

You can't sink an Armada. Armada is spread across free public servers. Nobody can switch it off. Not Discord. Not a slop cannon. Not us.

A Concord community whose relays, files, and voice are someone else's can keep going if Soapbox closes the website. The brand-new install uses their relay, their voice broker, their bridge, and their website. They can stop serving those. "Not us" describes the protocol after you have already left their defaults. The page that says "Not us" is the page that links Google Play, F-Droid, Zapstore, and https://armada.buzz/downloads.

Can Armada read my messages? No. Armada is an app, and your messages never pass through us. Concord communities and DMs are encrypted on your device, so nobody but the people in the conversation can read them. Not the relays, and not us. Even armada.exposed agrees.

This site agrees that Concord message text is sealed, that a passive relay cannot read that stored event, and that Concord voice will not join the room if encryption fails. The sentence "your messages never pass through us" is a different claim. One of the two default relays is relay.ditto.pub, which the new policy says Soapbox operates. A sealed envelope still arrives there. NIP-29 content is readable by that relay's operator. Bridged Discord channels are copied in plaintext. "Even armada.exposed agrees" puts this site's name on his sentence.

Don't like us? You don't have to use our app. Concord is an open protocol, and other people's apps open the same communities. Join with Vector or Amethyst and you're in the same channels as everyone on Armada, with nothing of ours in between.

Another client does not move the events. If the community's relay is relay.ditto.pub, Soapbox's relay is still in the path, whoever draws the window. "Nothing of ours in between" is true for a community that has already left their servers. The FAQ above that one admits the defaults are where a new install starts.

The install line on the page is curl -fsSL https://armada.buzz/install.sh | sudo sh. That is an instruction to download a script from their host and run it as root. This page did not audit install.sh.

Addendum, 14 October 2026. The script at that URL was fetched that day. It matches the copy in the Armada Stack repository. What it installs, and what a default server still contacts, is on the stack.

The iOS app he keeps naming

Three of his sentences put an iPhone app in the present tense.

The deck line on the same page is "Every deck: Web, Android, macOS, Linux and Windows." iPhone is not in that list. The self-host guide, still live on 9 October 2026, says "There is no iPhone app yet" and collects an email "the day it ships." The caveat box in that guide says "on iOS the app does not claim links at all yet." The downloads bundle can sort a .ipa artifact onto an iOS card if a release event contains one. The guide Soapbox publishes says the app has not shipped. His rebuttal argues with a waitlist by describing the keystore of an app the guide says is not there.

Addendum, 14 October 2026. On 12 October that guide's URL was replaced. The new post does not contain the iPhone sentence. The 9 October fetch, and the 13 September capture, do.

What the page does not say

The FAQ "What about the people behind Armada?" is the paragraph above: use another app. That is the whole answer he gives about the people.

On 5 August 2022 he wrote:

This is, of course, because I'm a transphobe. Because I don't believe faceless anime avatars online should have political influence over women's restrooms and sports.

In that post he stands by "Fuck you. All of you are total assholes." The 2019 essay, "Why I don't support transgender ideology," calls transgender ideology "a dogmatic cult" and says "I'm unashamedly opposed." It says sex cannot be changed, "nor can race or species," and it defines a trans woman as "a male who identifies as a woman." In the Gab post he writes that he has "no issue with trans-identifying people," that the target is an ideology, and "I'm still not a Nazi." He also writes that Gab has "literal Nazis" who "advocate for the extermination of races of people," and that the rest of Mastodon should stop blocking Gab. He says he is Persian, that "white heritage" politics are opposed to him, and that he is not a Nazi. Take him at that. The quotes, the archives, and the Truth Social job are on Who ships it. Reuters, 17 July 2023: Trump Media hired him in January 2022 as head of engineering, used Soapbox as the front end, and he resigned that day. His December 2022 note: Soapbox started as a fork of Gab's 2019 UI, was created for Spinster, and powers Truth Social. On 1 January 2026 the commit message is "I am BDFL, not CEO," and the media kit still said CEO when this site was written.

None of that is on armadaexposed.exposed. On the Reddit thread, at 01:52 UTC on 9 October 2026, u/Witty_Mycologist_995 posted peri80g:

ppl dont really hate armada because of those issues. they hate it because you're a transphobe. if you're not, please reply here and explain you are not.

A comment search on that post returned 54 comments. gleasonator13 is not among the authors. u/Any_Illustrator360 wrote, in pequsw8, that he "addressed the concerns with the app itself and avoided letting your character get in the way of it." The avoidance is the design of the page. The character is the 2022 sentence, and he has not taken it down.

The same silence covers the money sentence from the night before. "I didn't take any money from the nonprofit either" is still next to $3,100 and $1,200 in his own name. "Chad is the person who created it. It was just created around me" is still next to 1,463 commits under the name Chad Curtis on the canonical client, and next to a media kit leadership list that does not include Chad. The about page calls Chad "Head of VibeOps." The rebuttal's author line is "the crew."

M. K. Fain writes the marketing. The rebuttal does not mention her. Her Henhouse rules revoke the identity of men. The Promptworks letter and the essay title "Non-binary is the new 'not like other girls,' and it's deeply rooted in misogyny" are on her section. Sheila, the agent he says he built, is an admin of the soapbox.pub payee and filed $582,395.46 of the expenses. The rebuttal's grant joke does not mention her either.

What he fixed, and what he papered over

He removed the Plausible tag and the error-reporter tag from the homepage, and he deleted the sentence that said Armada does not operate the relays. The new policy names four of their servers. That is a real edit, made the night he posted, and it concedes the 7 October reading of those three lines.

The rest of the page is a rewrite. He shortens a qualified list into "the product works." He calls the next sentence of the self-host guide an invite-link caveat when the next sentence is the one about stopping after the frontend. He says messages never pass through them on a default path that includes relay.ditto.pub, which the new policy says Soapbox operates. He says this site agrees. He answers "what about the people" by telling you to open Vector. He is a transphobe by his own 2022 sentence, the essay is still the essay, the Truth Social web interface was based on Soapbox, the payee account is one he has administered since 2021, and the rebuttal is the page that says none of that.