How Auditly handles security.
We scan other websites, so we take the security of our own platform seriously.
Passwords
All passwords are hashed with bcrypt. Plain-text passwords are never stored or logged.
Transport security
All traffic between your browser and our servers is encrypted over HTTPS. HSTS is enforced.
SSRF protection
The scanner validates all URLs before fetching. Private IPs, loopback addresses, cloud metadata endpoints and internal network ranges are blocked.
Data isolation
Scan results are isolated per account. Authentication is required to access saved reports.
Responsible scanning
Auditly only performs passive, read-only checks. It does not perform active exploitation or mutation of the target website.
Report a vulnerability
If you discover a security issue in Auditly, please report it responsibly to security@auditly.io. We review all reports and respond within 48 hours.
Please do not publicly disclose vulnerabilities before giving us reasonable time to address them.