Security

Every control endpoint (add/remove targets, trigger a run, read results) requires an X-API-Key header — fails closed, never open.

Results are delivered directly to the destination you configure. We don't retain a copy or route your data through a third-party store.

Any LLM or delivery-integration keys the build uses are yours — you control the account and spend.

We collect only publicly visible data from the target(s) explicitly agreed at scoping.

Found a security issue?