Network request safeguards
Only HTTP and HTTPS on standard web ports are accepted. Credentials, local hostnames, private and reserved addresses are rejected; redirects are handled manually and revalidated before the next request.
Trust & legal
Security controls for a tool that fetches public URLs.
URL auditing creates a server-side request boundary, so the product treats every submitted address and fetched page as untrusted.
Resource and abuse limits
Requests and fetched HTML have hard size limits, the full redirect chain shares one deadline, concurrent audits are capped and repeated requests are rate-limited. The service reads HTML but does not execute the target page's scripts.
Browser response protections
Pages are served with a restrictive Content Security Policy, anti-framing, MIME-sniffing protection, referrer limits, browser feature restrictions and cross-origin isolation headers. Audit API responses are not cached.
Responsible disclosure
The public interface uses only the configured X profile and Telegram bot. Publish a security.txt file only when one of those channels is actively monitored for security reports.