Security

• PurlockBot only makes ordinary read requests over http and https. It never submits forms, logs in or runs actions on your site.
• It refuses private, internal and cloud metadata addresses (IPv4 and IPv6, including addresses hidden inside IPv6), checks again after every redirect, and connects only to the address it checked, so it can't be tricked into reaching internal systems.
• Every request has a time limit and a size limit, and it respects robots.txt. You can block it there; see the PurlockBot page.
• Pages that need JavaScript, and phone size checks, are opened in Cloudflare's browser service, not on our servers.

• Sign in uses single use links and codes that expire quickly, or Google or GitHub. Sessions use secure, HttpOnly cookies.
• Monitoring, checks of preview links and anything that acts on your site require you to prove you own it first (DNS record, meta tag or file).
• You can sign out on every device, download all your data, or delete your account from Account settings.
• Sensitive actions (verifying a site, editing facts, billing changes, sharing a report, deleting data) are recorded in an audit log.

• Every table holding customer data has row level security on, and every request is checked on our server to make sure it's yours.
• Text from scanned websites is always shown as text, never run as code, so a malicious page can't attack you through a report.
• Vercel preview bypass secrets and Stripe keys you connect for promotions are encrypted with AES 256 GCM, with the key held outside the database.
• We only accept restricted Stripe keys, and only need “Prices: Write”: Purlock can create prices and move lookup keys, but can't see customers, payments or payouts. You can disconnect at any time, which deletes the key.
• Reports are private by default. Only you decide whether a report link shows more than the score and finding titles.
• We keep data only as long as described in our Privacy Policy, and pages you paste into Check before you publish aren't stored.

Payments are handled by Stripe. We never see or store your card details. Every message from Stripe is checked against its signature before we act on it, and plan limits are enforced on our server.

• HTTPS everywhere with HSTS, a strict Content Security Policy, and protection against being framed by other sites.
• Bot protection (Cloudflare Turnstile) on public forms, rate limits on scans, sign in and requests, and daily caps on expensive work.
• Deploy hook links are unguessable, tied to one site and limited per day.
• Secrets live in environment variables, never in code.

• We watch for server errors without logging passwords, tokens, payment details or the contents of requests.
• Our dependencies are monitored for known vulnerabilities and kept up to date.
• Our providers are listed in the Privacy Policy, and our data processing terms cover business customers.

Found a security problem? Email support@spendjot.app with the subject "Security". We reply within 2 business days, keep you updated while we fix it, and won't take action against anyone who reports in good faith and doesn't access other people's data.