Security

This page describes implemented boundaries, not a certification or guarantee.

Target fetching

The production scanner accepts public HTTPS URLs on the default port, rejects credentials and ambiguous URL forms, validates that every DNS answer is public, pins validated addresses for the connection, revalidates redirects, observes robots policy, paces requests per origin, disables environment proxy inheritance, and caps redirects, time, encoding, content type, and bytes. A blocked fetch becomes incomplete coverage.

Private access and payment boundaries

Monitoring uses high-entropy bearer tokens whose hashes—not raw tokens—are stored. Dashboard responses are marked no-store and noindex. A short-lived Polar checkout is independently retrieved server-side and matched to the exact product, recurring cadence, amount, currency, active subscription, checkout-bound free-scan intent, and separately delivered activation secret. Only the activation-secret HMAC is stored. Signed webhook bodies are verified before a PII-free durable event is processed.

Data minimization

Monitoring stores bounded public-text excerpts and structured evidence, not raw HTML. It does not store payment-card data, customer email in the RIA entitlement, or raw webhook bodies. Public adviser issue pages, scores, rankings, and badges are not produced.

Responsible reporting

To report a suspected vulnerability, email qi@toledotechnologies.com with “Security” in the subject. Do not access other customers’ data, disrupt service, use social engineering, or test third-party targets without authorization.