VulnQuill

Trust & security

VulnQuill holds your clients' most sensitive material — unpatched vulnerabilities, exploit evidence, internal hostnames. This page describes, plainly and without compliance theater, how that data is protected. Questions or disclosures: mail@anir0y.in.

Tenant isolation

Every workspace is organization-scoped. Authorization is enforced inside every server action — not just at the routing layer — using a shared access-control check (same-org or explicit engagement membership; client-portal users must be members). Admin rights are re-read from the database on sensitive mutations, never trusted from the session token.

Authentication

• Passwords hashed with bcrypt (cost 12); login lockout on repeated failures.
• Passkey / WebAuthn sign-in, with step-up verification for sensitive actions.
• Single-use, hashed, expiring tokens for email verification and password reset.
• API keys stored hashed; timing-safe comparisons throughout.

Application security

• Strict nonce-based Content-Security-Policy (strict-dynamic) and HSTS on every response.
• Report PDFs render with JavaScript disabled and all finding text HTML-escaped.
• Third-party provider keys encrypted at rest with AES-256-GCM.
• Recon features filter private/metadata IP ranges before any probe (SSRF guard).
• Signup rejects disposable-email domains; per-IP rate limiting on public endpoints.

Auditability

Two audit layers: a per-organization activity log (who did what, visible to your admins) and an append-only platform audit log for operator actions. Data exports are themselves logged.

Durability & operations

• Nightly encrypted (age) backups of the database and uploaded evidence to offsite object storage, with rolling retention.
• Error tracking with PII scrubbed before capture; live health endpoint on the status page.

What we don't claim

VulnQuill is an independent product and does not currently hold SOC 2 or ISO 27001 certification. We'd rather tell you exactly what is implemented than sell you a badge. If your procurement needs a security questionnaire answered, email us — we answer them honestly and fast.

Vulnerability disclosure

Found a vulnerability in VulnQuill? Email mail@anir0y.in (see security.txt). Good-faith research against your own workspace is welcome; don't access other tenants' data. Disclosures are credited in the changelog with your permission.