Security

Built to be
trusted with your stack

We audit other people's websites for a living, so we hold our own to the same bar. No vague badges here — just the concrete controls protecting your account and your data, described plainly.

Encryption

Third-party API keys you store are encrypted at rest with AES-256-GCM — never written to disk or logs in plaintext.
All traffic to slapmyweb.com and api.slapmyweb.com is served over TLS, terminated at the edge.

Authentication

Passwords are hashed with bcrypt — we never store or can read your password.
Sessions use short-lived JWTs with the signing algorithm pinned (HS256), closing alg-confusion attacks.
Sign in with Google OAuth, and repeated failed logins trigger an exponential lockout.

Application security

Every scan target runs through an SSRF guard that re-validates resolved IPs — including the headless browser — so a scan can never reach internal or metadata addresses.
All API and queue inputs are validated with Zod at the boundary before anything touches the database.
A strict Content-Security-Policy, security headers (Helmet), and HTML sanitization (DOMPurify) ship on every response.

Infrastructure

Self-hosted and process-isolated — your data is not handed to a sprawl of third-party sub-processors.
Redis-backed rate limiting protects auth, scanning, and the public API from abuse.

Privacy

Your scan results and reports are yours. We do not sell them and we do not feed them to ad networks.
Logs are scrubbed of personally identifiable information — we record metadata, not your private data.
The 160+ free browser tools run entirely client-side; that data never leaves your device.

Responsible disclosure

Found a vulnerability? We want to hear about it. Our policy and contact live in our security.txt.
We triage reports promptly and will not pursue good-faith researchers who follow the policy.

Have a security question, need a DPA, or want to report something?

View security.txt Contact the team

Security is a pillar,
not an afterthought.

Every scan checks TLS, headers, cookie flags and mixed content — on the free plan too.

Run a free audit

Free foreverNo signupResults in 30s

Built to be trusted with your stack

Encryption

Authentication

Application security

Infrastructure

Privacy

Responsible disclosure

Security is a pillar,not an afterthought.

Built to be trusted with your stack

Encryption

Authentication

Application security

Infrastructure

Privacy

Responsible disclosure

Security is a pillar,not an afterthought.

Built to be
trusted with your stack

Security is a pillar,
not an afterthought.

Built to be
trusted with your stack

Security is a pillar,
not an afterthought.