Security

How we handle your information.

A security firm should be able to answer this on one page. Here's ours, plus how to report a problem with this website.

Principles

  • We never hold your credentials. Hardening happens with you at the keyboard, or through roles and vault access you grant and can revoke. There is no ShutOut master password to steal.
  • We collect the minimum. This website stores what you type into a form, when, and basic request metadata to prevent abuse. No analytics trackers, no ad pixels, no social widgets.
  • Client records live off this website. Engagement files, exposure reports and documentation are kept in encrypted, access-controlled systems separate from the public site, under written confidentiality.
  • Humans with keys are the risk, so we limit them. Hardware-key two-factor on every internal system, named access per client, offboarding the same day. We run the Lockdown on ourselves.
  • Breach lookups aren't stored. If the exposure page's breach check is enabled, your address is sent once to Have I Been Pwned over an encrypted connection and not retained; a hashed, one-hour cache prevents repeat queries.
  • We tell you. If we ever have an incident affecting your data, you hear it from us first, in plain language, with what we're doing about it.

This website

What's under the hood.

  • HTTPS everywhere with HSTS. Security headers set: content-type sniffing off, framing restricted, referrer policy tightened, browser features locked down.
  • Forms are protected by same-origin tokens, honeypots, timing checks, rate limits and content screening. Mail is plain text. Nothing you type is rendered unescaped anywhere.
  • XML-RPC disabled. User enumeration blocked. File editing from the admin disabled. Software versions hidden. Automatic updates on.
  • Submissions are stored privately and purged on a schedule; see the privacy policy for retention.
  • No third-party scripts except web fonts and, if enabled, Cloudflare's bot check on forms.

Vulnerability disclosure

Found something? Tell us. We'll be grateful, not defensive.

If you believe you've found a security issue in this website or anything else we run, email intake@shutout.io with "Security" in the subject. Signal is available on request for sensitive reports. Our security.txt is published per RFC 9116.

What we ask. Give us a reasonable chance to fix it before publishing. Don't access, modify or exfiltrate data that isn't yours. No denial of service, no social engineering of our people, no physical attempts. Stay within the law.

What you can expect. Acknowledgment within two business days, an honest timeline, credit if you want it, and no legal action for good-faith research that follows these rules. We don't run a paid bounty program today; we do say thank you properly.

Out of scope. Our hosting provider's infrastructure, third-party services we link to, missing best-practice headers with no demonstrated impact, and reports generated by automated scanners without validation.