Security

Report a vulnerability

Email [email protected] with the affected hostname, a concise description, reproducible steps and the minimum evidence needed to validate the issue. Please do not include passwords, API keys, payment details, personal data or other secrets. Do not perform destructive testing, denial-of-service testing, social engineering or testing against another customer’s data.

For crawler abuse or unexpected traffic, identify the relevant User-Agent, source address, timestamp and target path. Site owners can also block the crawler using their own WAF or server controls.

Account and API protection

• Account sign-in is delegated to the central NOTABIS identity service.
• Account ownership, entitlements, NT balance and audit history are checked before protected operations.
• API access requires an API key and scope; keys are shown once at creation and should be stored outside source control.
• Protected web operations use sessions and CSRF protection; API and audit endpoints are rate-limited where appropriate.
• Internal crawler coordination uses authenticated, signed requests and contract validation.

Crawler safety controls

The crawler identifies itself, reads robots.txt before crawling, honours Allow, Disallow and Crawl-delay rules, validates destinations, stays within the target origin, and applies page, depth, timeout, response-size, redirect, retry and request-rate bounds. It does not bypass authentication, WAFs, CAPTCHAs, anti-bot challenges or robots restrictions.

Data handling

Audit URLs, measurements, findings, report identifiers, progress records and rendered evidence are processed to provide the service. We avoid placing secrets in reports and operational diagnostics where possible. Do not submit secrets or confidential URLs unless authorised. See the Privacy Policy for the current data-use description.

Infrastructure and monitoring

The service uses HTTPS, secure-cookie settings, security headers, managed environment credentials, queue and worker health checks, bounded browser rendering, operational logging and service-status monitoring. Components can fail or become unavailable; status information is available on the operations status page.

Incident handling

We investigate credible reports, restrict access or traffic where necessary, preserve relevant evidence, remediate the cause and coordinate notifications when required. We communicate material incidents through appropriate customer or support channels.

Security maintenance

We review dependencies, access controls, secrets handling, crawler boundaries, logging and exposed endpoints as the service changes. Independent security testing, formal retention automation, backup-restore drills and a maintained subprocessor register should remain part of the service’s ongoing release and governance work.

Contact

Security and privacy contact: [email protected]. Never send credentials or secret material by email.