Security
Stated as of today, in the present tense, and revised when it changes. A security page describing controls that are not built yet is the worst overclaim available to us.
What this site collects
Nothing. There is no account, no form, no analytics script, and no cookie. The scan intake is not open, so no email address or domain has been submitted to it.
Controls that exist now
Modest, because the surface is modest. These are the ones that apply to a server-rendered public site with no user data.
- TLS on every route, with HTTP redirected to HTTPS.
- Credentials in environment configuration only, never in the repository.
- A secret scan over the staged diff and the full tree, run as a release gate.
- Primary content rendered server-side; no third-party script executes here.
- Dependency and type checks in the same gate that blocks a release.
Controls that land with the assessment workflow
Named here so the gap is visible rather than implied. These arrive with the software that handles customer data, not before it.
- Row-level security and tenant-aware checks on every customer record.
- Crawler protections against server-side request forgery: private networks and metadata endpoints blocked, redirects revalidated, protocol and size capped.
- Retrieved text and model output treated strictly as data. Instructions embedded in a crawled page are quoted as evidence, never executed.
- Audit events on privilege changes and any publication action.
- Human authorization required before any result about a company is published.
Reporting an issue
If you find a vulnerability in this site, report it before disclosing it. We will confirm receipt, tell you what we found, and credit you if you want the credit.
A published result about a company is a different kind of problem — corrections covers that.