Security Policy

Reporting a Vulnerability

Please do not disclose security vulnerabilities publicly before contacting us.

Email support@website-auditor.io with:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept (text only — do not attach exploit binaries)
• Any relevant logs, screenshots, or code references

You can expect an acknowledgement within 48 hours and an initial status update within 7 days. Critical findings (remote code execution, auth bypass, SSRF that bypasses the existing guards, sensitive data exposure) are triaged ahead of routine work.

Scope

In scope:

• Authentication or authorization bypass on api.website-auditor.io flows surfaced through the dashboard
• Server-Side Request Forgery (CWE-918) bypassing our outbound-request guards
• Cross-Site Scripting (XSS) on website-auditor.io rendered content
• Cross-Site Request Forgery (CSRF) on any state-changing endpoint
• Supply-chain issues in pinned third-party dependencies

Out of scope:

• Denial-of-service (resource-consumption testing) — please report rate-limiting gaps as findings, but do not exercise them at volume
• Self-XSS that requires a user to paste code into devtools
• Issues that require physical access to a device
• Reports that an endpoint needs no account — some audit endpoints are intentionally reachable without one. Obtaining subscription-gated results without a valid entitlement is in scope

Security Controls Relevant to Testing

These are the protections in place, described by what they guarantee rather than by how they are built — enough to aim a test and to tell an intended behaviour from a bug. We do not publish our component, platform or network inventory. If confirming a control's boundary is the difference between a report and a guess, ask in your report and we will answer directly.

• Transport and browser hardening: HTTPS is enforced for the site and its subdomains (HSTS, preloaded), responses carry a restrictive Content-Security-Policy with violation reporting, framing is denied, and browser features are permitted only where needed.
• Gated capability: AI-visibility queries require a valid subscription entitlement, checked server-side on every request. Other audit endpoints are intentionally usable without an account.
• SSRF defence: outbound requests are validated before they are issued, and every redirect hop is re-validated against private and reserved address ranges. A chain that reaches an internal range is a finding; a redirect that is correctly refused is the control working.
• CSRF defence: state-changing requests are rejected unless they prove same-origin intent, and browser form submissions additionally carry a per-session token.
• Secrets and credentials: held server-side only and never sent to the browser.

Safe Harbor

Armstrong HoldCo LLC will not pursue legal action against researchers who:

• Make a good-faith effort to comply with this policy
• Avoid privacy violations, denial-of-service, and destructive testing
• Give a reasonable disclosure window before going public

Thank you for helping keep Website Auditor and its users safe.