Security
Built to be
trusted with your stack
We audit other people's websites for a living, so we hold our own to the same bar. No vague badges here — just the concrete controls protecting your account and your data, described plainly.
Encryption
- Third-party API keys you store are encrypted at rest with AES-256-GCM — never written to disk or logs in plaintext.
- All traffic to slapmyweb.com and api.slapmyweb.com is served over TLS, terminated at the edge.
Authentication
- Passwords are hashed with bcrypt — we never store or can read your password.
- Sessions use short-lived JWTs with the signing algorithm pinned (HS256), closing alg-confusion attacks.
- Sign in with Google OAuth, and repeated failed logins trigger an exponential lockout.
Application security
- Every scan target runs through an SSRF guard that re-validates resolved IPs — including the headless browser — so a scan can never reach internal or metadata addresses.
- All API and queue inputs are validated with Zod at the boundary before anything touches the database.
- A strict Content-Security-Policy, security headers (Helmet), and HTML sanitization (DOMPurify) ship on every response.
Infrastructure
- Self-hosted and process-isolated — your data is not handed to a sprawl of third-party sub-processors.
- Redis-backed rate limiting protects auth, scanning, and the public API from abuse.
Privacy
- Your scan results and reports are yours. We do not sell them and we do not feed them to ad networks.
- Logs are scrubbed of personally identifiable information — we record metadata, not your private data.
- The 160+ free browser tools run entirely client-side; that data never leaves your device.
Responsible disclosure
- Found a vulnerability? We want to hear about it. Our policy and contact live in our security.txt.
- We triage reports promptly and will not pursue good-faith researchers who follow the policy.
Have a security question, need a DPA, or want to report something?
Security is a pillar,
not an afterthought.
Every scan checks TLS, headers, cookie flags and mixed content — on the free plan too.
Run a free auditFree foreverNo signupResults in under a minute