Security and data handling
How this website and the client dashboard protect your account and your requests, what we will never ask you for, and how to report a vulnerability to us. This page describes controls that are in place, not plans.
What we never ask for
Do not send any of the following through the dashboard, in a message or by email. We will not ask for them.
- Passwords, including server, hosting control panel and application passwords
- Private keys, including SSH keys and TLS certificate keys
- Access tokens and API keys
- Customer data, such as database exports or records about your users
Where a job needs access to your systems, it is agreed separately, scoped to that job and set up through an agreed channel. See access and authorization.
If you have sent one of these to us by mistake, rotate or revoke it, then tell us through the contact form so we can remove it from the request.
Accounts and sessions
- Passwords are never stored in plain text. Only a salted, one-way hash is kept.
- Sign-in sessions use cookies marked HttpOnly, so page scripts cannot read them, and SameSite=Lax. On the live site they are also marked Secure, so they are only sent over HTTPS.
- Every request that changes data must carry a per-session anti-forgery (CSRF) token.
- Sign-in attempts are rate limited, both per network address and per email address.
- Each customer account can see only its own requests, reports and evidence.
Requests and reports
An assessment request holds what you enter in the form: your company, a public website address, the hosting environment, the PHP version if known, the number of servers and sites, urgency and any context you add. The form rejects website addresses that contain credentials.
Findings, quotes, messages and payment records are kept with the request in your dashboard. Evidence files are only reachable through download links that expire after five minutes, issued to the account that owns the request.
Payments
Card payments are taken on Stripe’s hosted checkout page. Card details are entered on Stripe, not on this website, and never reach our servers.
Returning from checkout does not by itself mark a request as paid. Payment status is confirmed with Stripe, and notifications from Stripe are signature-checked before they are accepted.
Online checkout opens once payment setup and delivery capacity are confirmed.
This website
- Page views are counted with Vercel Web Analytics, which sets no cookies, is served from this domain and records the page path without query strings. Pages load no third-party scripts, fonts or images.
- A strict Content Security Policy: only scripts authorized by a per-request nonce can run, other sites cannot frame these pages, and forms may only submit to this site, Stripe checkout or email.
- The free response checklist stores your progress in your own browser only. It is never sent to us.
Reporting a vulnerability
If you believe you have found a security vulnerability in this website or the client dashboard, send it through the contact form. Our contact details are also published in security.txt.
Please include
- The affected page or endpoint and the steps to reproduce the issue
- What an attacker could achieve
- How we can reach you for follow-up questions
Please do not
- Access, change or delete data that is not yours
- Run denial-of-service or automated high-volume testing
- Disclose the issue publicly before we have had a reasonable chance to fix it
Vulnerabilities in PHP itself should be reported to the PHP project, not to us.