Security
A security testing platform has to hold itself to a higher standard. Here is exactly what we do to protect your account and scan data.
All data between your browser and our servers is encrypted via TLS 1.2+. Sensitive values (API tokens, passwords) are encrypted at rest using AES-256 before being written to the database.
Passwords are hashed using bcrypt with a unique per-user salt. We never store or log plaintext passwords. If our database were ever compromised, your password would remain protected.
Scan workers run in isolated containers that are destroyed after each scan. No scan data persists in the execution environment - only in your account in the database.
Every target URL is checked against your verified domains before a scan starts. This prevents Vulnara from being used as a tool to attack third-party systems.
We run automated dependency scanning and update critical security patches within 48 hours of disclosure. Our CI pipeline blocks builds with known critical vulnerabilities.
We welcome responsible disclosure of security vulnerabilities in our platform. We commit to responding within 48 hours, crediting your contribution, and not pursuing legal action against good-faith researchers.