Security

A plain statement of what is in place and what is not. No certifications are claimed.

In place (verifiable)

• HTTPS only. HTTP redirects permanently; HSTS is set with a one-year max-age. Check with curl -I https://sarembok.com.
• Response headers: X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, restrictive Permissions-Policy. The server banner is stripped.
• Specification extraction runs in a separate browser service, not in the web-facing process.
• Source is public: github.com/jetsontech/SarembokVE. The edge config is Deployment/cloud/edge/Caddyfile.

Know before you use it

• Targets you submit are fetched by our servers. Do not submit credentials you are not willing to send to a third-party service. Header and token options on /api/spec are forwarded to the target you name.
• Only audit systems you own or are authorised to test.
• Spec results may be cached for up to 30 minutes unless you request a fresh run (fresh=1, used by sarembok audit).

Not in place

• No SOC 2, ISO 27001 or similar audit.
• No third-party penetration test has been published.
• No bug bounty. Good-faith reports are welcome and will be credited if you wish.

Report a vulnerability

Use GitHub's private reporting: open a private security advisory. Please do not file public issues for undisclosed vulnerabilities.

See also the privacy policy and terms.