Security

Overview

Security is part of how we build WebURLTracker, not a separate brochure. This page summarizes the controls we run today. For privacy details, see the Privacy Policy. For rights requests, see GDPR.

Questions: email [email protected].

Authentication

Sign-in is handled by Clerk. Protected API routes require a valid session JWT. We do not store your password; Clerk does.

Transport and access

Traffic to the app and API uses HTTPS. Workspace data is scoped so one workspace cannot read another’s monitors or diffs through the API.

Monitor URL safety

Cloud workers refuse private, link-local, and localhost targets. That reduces the chance someone uses our capture fleet as an open proxy into internal networks.

Capture data

Screenshots and extracts live in object storage tied to your workspace. Retention follows your plan. Deleting a monitor removes its active history as cleanup runs.

Local checks run in your browser. We receive the extract needed for baselines and diffs, not a full dump of every tab you have open.

Secrets

Service secrets (database, object storage, auth) stay on the server. Frontend env vars are limited to publishable values such as the public API URL and Clerk publishable key.

Abuse and rate limits

API usage is rate-limited. We may throttle or block accounts that hammer endpoints or attempt unauthorized access.

Reporting a vulnerability

If you find a security issue, email [email protected] with steps to reproduce. Please give us a reasonable window to fix before public disclosure.