Skip to main content

Trust

Security and how scanning works

Last updated 6 October 2026

What DefexityBot does

When you submit a URL, DefexityBot makes a small number of read-only HTTP requests (GET and HEAD) to that site: the page itself, its own JavaScript files, robots.txt, sitemap.xml, a non-existent URL to test the error page, and a fixed list of well-known sensitive paths such as /.env. It never submits forms, logs in, runs your JavaScript, or sends data to your APIs.

  • User agent: DefexityBot/1.0 (+https://defexity.com/security#scanner; read-only production-readiness scan)
  • At most 80 requests per scan, 4 at a time, with size and time limits on every response.
  • API routes found in your JavaScript are only requested with GET, without cookies, and never if the path looks like it changes data.
  • Scans of the same site are rate-limited per visitor and per target domain.

Opting out

DefexityBot follows robots.txt. To block it, add:

User-agent: DefexityBot
Disallow: /

Protecting the scanner itself

  • Only public http and https URLs on ports 80 and 443 are accepted.
  • Every DNS answer is checked at connection time, and again on every redirect, so private, loopback, link-local and cloud-metadata addresses can never be reached.
  • Secrets found on a site are masked before they are stored; the full value never leaves the scanner.
  • IP addresses are stored only as keyed hashes for rate limiting.

Application security

Defexity uses a nonce-based Content Security Policy, HSTS, strict same-origin checks on state-changing requests, validated input on every API route, and tenant isolation on every database query. Database tables deny direct client access.

Reporting a vulnerability

If you believe you have found a security issue in Defexity, please email defexity.help@gmail.com with the details. Please do not test against other customers’ data, and give us reasonable time to fix the issue before disclosure.