Security

Nothing that grants access to anything of yours. KeyDrift reads what your site already serves to every visitor — the page, and the JavaScript it links to. There is no repository integration, no CI token, no cloud role and no API key.

The two Veristria products that do ask for a credential make that clear on their own security pages. This one does not, and the difference is architectural rather than a setting we could change.

It cannot write. Only GET and HEAD requests are ever issued, and that is enforced in the fetch layer rather than at the call sites — the function that would send anything else throws instead. Pointing the scanner at a site is impolite, never harmful.

It cannot be aimed inside a network. Loopback, RFC1918, link-local, carrier-grade NAT and the cloud metadata endpoints are refused before the socket opens, and re-checked on every redirect hop. A 302 to the metadata address is the whole attack, and validating only the first URL misses it.

It cannot store a live secret. A discovered value exists as a string inside the detection engine and nowhere else. What leaves is a mask — first eight and last four characters, never more than half the string — and a salted SHA-256 fingerprint. No column in the database can hold a live credential, so there is nowhere to put one by mistake.

It cannot leak your network topology through an error. Fetch failures routinely embed resolved addresses and internal hostnames, so they are mapped to a fixed set of phrases before they reach you.

In transit. Everything is HTTPS.

At rest. Managed Postgres with provider-level disk encryption. Webhook secrets you configure for alerts are encrypted on top of that.

Sign-in. Magic links. We store no passwords, so there is no password database to breach and no reuse risk to inherit from your other accounts.

Alert destinations. A webhook URL you supply is validated when you save it and again before each delivery, so a destination that later resolves somewhere it should not is caught at send time rather than at save time.

No certifications. No SOC 2 report, no ISO 27001, no PCI attestation. The company is weeks old and we will not imply otherwise on a sales call. What we offer instead is that every control above is checkable, and that the scanner is built so the worst-case version of us still cannot write to your systems.

Rate limiting is per instance. The counters live in the process serving your request, so behind more than one instance the effective limit multiplies by the instance count. It is a courtesy limit and a cost control, not a defense against a distributed abuser.

DNS rebinding is an egress problem. We validate the address before connecting and again on every hop, which stops the redirect attack. A hostname that resolves differently between our check and the socket belongs to the egress layer, and we do not claim to have solved it here.

No bug bounty yet. We pay nothing for reports today. If that changes it will be announced here first.

Scans belonging to an account go when the account goes. Scans run without an account are kept until you ask us to remove them — we have not built an automatic expiry, and saying so is more useful than publishing a window we do not enforce. Send us the report link and we delete it, public page included.

The full picture of what a scan stores is in the privacy policy.

Email info@useveristria.com with “Security report” in the subject. We acknowledge within a few business days, agree a timeline with you, and credit you when it is fixed unless you would rather stay anonymous.

Please do not run automated scanners at volume against production, do not touch data belonging to anyone else, and stop once you have proved the point. We will not pursue anyone who reports in good faith and stays within that. The longer version, including scope, is at responsible disclosure.