1. Security Approach
Security is a foundational consideration in the architecture, deployment, and day-to-day operations of SiteSecura.
As a cybersecurity platform, we implement technical and organizational controls designed to protect customer accounts, target configurations, scan histories, generated reports, and our underlying infrastructure. Our security controls evolve continuously as modern attack surfaces adapt and our platform expands.
2. Application Security
SiteSecura incorporates defensive software engineering practices throughout the codebase:
- Server-Side Authorization: Every administrative action, scan trigger, and report query is verified on the backend independently of client-side UI states;
- Input Sanitization & Validation: Target domains and user inputs are strictly validated against restrictive regular expressions to prevent injection attacks;
- Rate Limiting & Burst Controls: Multi-tiered rate limiters protect public endpoints and authenticated APIs against brute-force and resource-exhaustion traffic;
- Protected API Endpoints: Bearer token verification and organization membership checks guard private endpoints; and
- Security Auditing: Sensitive operational events (such as membership changes, quota adjustments, and scan triggers) record structured audit log entries.
3. Authentication Architecture
SiteSecura utilizes Firebase Authentication (Google LLC) for account identity management, session tokens, and OAuth integrations (Google Sign-In).
Plain-text passwords are never received or stored within SiteSecura's application databases. Authentication tokens are cryptographically verified by our backend services on every authenticated request. Application authorization is handled separately by SiteSecura's internal role-based access controls.
5. Scanner Infrastructure & SSRF Defense
Because SiteSecura performs outbound network requests to assess target websites, our scanner engine incorporates rigorous Server-Side Request Forgery (SSRF) defenses to prevent internal network probing:
- Domain Normalization: Strips extraneous URI components, ports, and credentials before resolving;
- Forbidden Hostname Blacklisting: Blocks requests to
localhost,.local,.internal, and reserved local hostnames; - IP Address Validation: Authoritative pre-scan DNS resolution validates that target IPs are publicly routable;
- Private Network Blocking: Rejects loopback addresses (
127.0.0.0/8,::1), private subnets (RFC 191810.0.0.0/8,172.16.0.0/12,192.168.0.0/16), and link-local ranges; - Cloud Metadata Isolation: Explicitly blocks cloud instance metadata endpoints (including
169.254.169.254); and - Redirect Chain Verification: Inspects and re-validates each hop throughout HTTP redirect chains (capped at 5 hops) rather than solely checking the initial URL.
6. Transport Security & Encryption
All communications between user browsers and SiteSecura services are encrypted in transit using HTTPS and TLS. We deploy modern cryptographic cipher suites and enforce HTTP Strict Transport Security (HSTS) across our public domains.
7. Secrets & Credential Management
Application secrets, database credentials, third-party API keys, and signing secrets are managed through secure server-side environment configurations.
Private keys and API credentials are never checked into public version control or exposed to client-side web application bundles.
8. Logging & Operational Monitoring
SiteSecura maintains centralized application, security, and operational audit logs to:
- Troubleshoot technical anomalies and scan errors;
- Detect scanning abuse, brute-force attempts, and unauthorized activities;
- Investigate security events and support incident response; and
- Maintain platform availability and task queue performance.
Access to operational logs is restricted strictly to authorized engineering personnel with a demonstrated operational need.
9. Backups & Disaster Recovery
To safeguard against data loss, SiteSecura uses automated database backups to support operational recovery. Backup and recovery practices depend on the production infrastructure and may change as the platform evolves.
10. Third-Party Service Providers
SiteSecura relies on vetted third-party infrastructure and service providers to support authentication, payments, email notifications, and network acceleration.
For a comprehensive and transparent inventory of external service providers, please review our Subprocessors & Third-Party Services page.
11. Security Incidents
If SiteSecura identifies a security incident affecting customer data or system availability, our engineering team will investigate promptly and implement containment and remediation measures appropriate to the circumstances.
Where notification is required by applicable law, regulation, or contractual commitments, SiteSecura will notify affected customers without undue delay.
12. Vulnerability Reporting
We encourage security researchers and users to responsibly disclose any potential security concerns. For guidelines on submitting findings, please visit our Responsible Disclosure Policy.
13. Important Limitations
REALISTIC SECURITY BOUNDARIES
No internet-connected service can guarantee absolute security. SiteSecura's security controls are designed to reduce risk, but they do not eliminate all possible threats. Security scores and findings are informational indicators and do not guarantee immunity from exploits or zero-day vulnerabilities.
14. Security Contact
For security inquiries or verification questions, reach our security team:
Entity: [SiteSecura]
Security Inquiries: [security@sitesecura.com]
Legal & Privacy Contact: [legal@sitesecura.com]
Registered Address: [Indore, Madhya Pradesh]