How we keep scanning safe

• Passive only. A free scan makes a small number of normal GET requests: your home page, its same-origin JavaScript files, robots.txt, sitemap.xml, /.env and /.git/config, plus any source map files your scripts point to. That is the same kind of traffic a browser makes.
• No logins, password guessing, fuzzing, exploit attempts or database queries.
• Requests identify themselves with the user agent StackSiren/1.0 (+https://stacksiren.com; passive security scan).
• Each request has a timeout and a size cap. The scanner refuses IP addresses, internal hostnames and domains that resolve to private or internal networks, and re-checks every redirect.
• Scans are rate-limited per visitor and per target site.
• You must confirm you own the site or have permission to scan it. See the terms.
• A good score doesn't prove an app is secure. We can't see server code, database rules or pages behind login. StackSiren is not a penetration test.

• Secrets found in your public code are masked in results and reports. We show only the start and end of a key, never the full value.
• For an exposed /.env file we report how many variables it contains, not their values.
• We store a summary of each scan (score, issue titles, severities) so it can appear in your dashboard. See the privacy policy for what we keep and how to have it deleted.

• No passwords. You sign in with a one-time email link that expires after 15 minutes. The link's token travels in the URL fragment, so it never reaches server or CDN request logs. We store only a hash of it.
• Sessions use a __Host- cookie that is httpOnly, Secure and SameSite=Lax. We store only a hash of the session token, and signing out deletes the session.
• Changes you make in the dashboard are protected against cross-site request forgery with origin checks and a per-session token.
• Payments are handled by Stripe. Card details go straight to Stripe and never touch our servers.
• The site sends HSTS and a restrictive frame-ancestors policy so it can't be framed by other sites.

Found a security issue in StackSiren itself? Email support@stacksiren.com with the details and steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and don't access other people's data or disrupt the service while testing.

Our contact details are also published in /.well-known/security.txt.

If you believe someone used StackSiren to scan your site without permission, email abuse@stacksiren.com with your domain and the approximate time (UK time if you can). Our requests carry the StackSiren user agent above, so you can match them in your logs.