Security by architecture, not afterthought.
We apply the principles of least privilege, strict tenant isolation, and defense-in-depth across our scanner engine, data persistence, and AI pipelines.
Defense-in-depth security engineering.
Multi-Tenant Data Isolation (RLS)
All persistence tables enforce PostgreSQL Row-Level Security policies. Every read, write, and scan query is cryptographically bound to the authenticated organization and user.
Socket-Level SSRF Containment
Custom HTTP agent hooks resolve DNS and inspect target IP addresses at the raw socket creation boundary, strictly blocking private RFC 1918 subnets, cloud metadata APIs (169.254.169.254), and DNS rebinding attacks.
AI Prompt Injection Defense
All untrusted website DOM snippets, meta tags, and scraped payloads are sanitized and encapsulated within safe XML boundary delimiters before being processed by language models.
Automated Credential Scrubbing
Heuristic pattern detectors identify API keys, authorization tokens, passwords, and private hashes in scanned response headers, redacting them before evidence is stored or sent to AI providers.
Cryptographic Webhook Signatures
All outbound webhook events deliver an HMAC-SHA256 signature in the x-scanfix-signature header, allowing consumers to verify message authenticity and guard against replay attacks.
Strict Transport Hardening (HSTS & CSP)
All production endpoints enforce strict HTTPS transport with HSTS preload directives, comprehensive Content-Security-Policy rules, and restrictive Permissions-Policy headers.
Responsible Vulnerability Disclosure
If you discover a security defect, please report it responsibly by contacting our engineering security team. We acknowledge incoming reports within 48 hours and coordinate fixes before public disclosure.
security@scanfix.dev (PGP encrypted reports supported)Evaluate our security in action.
Create a free account to test tenant isolation, RBAC permissions, and SSRF protections with 2 free audits included.