Security built in by design.
Norveth is engineered to evaluate websites while adhering to strict credential protection, network isolation, and responsible crawling practices. No certifications are claimed here that haven't been earned — see the Trust Center for where things stand.
Authentication & secret protection
All passwords are hashed with bcrypt-12. API keys are hashed and shown only once, at creation. One-time verification codes use cryptographically random bytes with constant-time verification.
SSRF & network defense
The analysis crawler validates every target hostname before fetching it, blocking requests to internal IP ranges (RFC 1918, RFC 3927), loopback addresses, and cloud metadata endpoints.
Responsible crawling
Norveth honors robots.txt and rate-limits its own outbound requests to a target site. Each crawl runs in an isolated headless Chromium instance.
Data isolation
Projects, reports, and AI chat context are scoped per organization with row-level authorization checks on every API endpoint that reads or writes them.
Responsible disclosure
If you find a security vulnerability in Norveth, please report it — see the full disclosure policy for scope and safe-harbor terms.