Security Disclosure

1. Security Architecture

Adticks secures authentication and data flows using TLS encryption in transit and AES encryption at rest. Logins are supported via Google OAuth or email/password authentication. Passwords are hashed with Argon2id before storage, and session tokens are cryptographically signed and HTTP-only to prevent client-side tampering.

2. Crawl and Scanning Integrity

Our crawler pipeline is built to respect website directives. We check your site's robots.txt directives and crawl thresholds prior to parsing your page hierarchy. To prevent accidental resource exhaustion, our crawlers implement rate-limiting and concurrent request caps.

3. Access Controls

Audit data is scoped strictly to the authorized account. Only authenticated users associated with a project can access scan results, history reports, and competitor benchmarks. We do not expose scanned source materials publicly.

4. Secure Coding Practices

We compile code with rigorous linters, static analyzers, and dependency security audits (`pip-audit` and `npm audit`) to avoid supply chain vulnerabilities. API routes employ strict CORS policies and security headers (such as Content Security Policies and clickjacking frame blocks).

5. Vulnerability Disclosure Policy

We value the contributions of security researchers. If you identify a potential security issue in the Adticks platform, please email us directly at [email protected]. Please provide a clear description of the vulnerability, step-by-step reproduction instructions, and your contact details. We ask that you avoid disclosure until we have had an opportunity to mitigate the issue. Target acknowledgment: within 5 business days when possible.

Machine-readable contact: /.well-known/security.txt.

6. Transport and browser hardening

Production serves HTTPS with HSTS, Content-Security-Policy (nonce-based scripts), X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, and a restrictive Permissions-Policy. Auth and signup endpoints are rate-limited at the edge.