Trust & security
Security at ScriptProof
How we protect your data — and why we never touch your customers’. A security product has to hold itself to the standard it monitors. This page describes, in plain terms, exactly what we store, how the platform is built, and where our limits are.
No cardholder data, ever No agent required Outside-in monitoring only
The core promise
Data we handle vs. data we never touch
ScriptProof is deliberately designed so that the most sensitive data on your site — your customers’ — has no path into our systems.
What we store
Your account email
Verified at signup before any account exists. Used for alerts and login only.
Site URLs you register
The payment-page addresses you explicitly ask us to monitor, after domain verification.
Script metadata & SHA-256 hashes
Script URLs, sizes and content fingerprints — never the pages your customers type into.
HTTP response headers
The security headers your pages serve (CSP, HSTS, etc.), snapshotted per scan.
Alerts & evidence records
Change events, before/after hashes, authorizations and the monthly Evidence Pack.
What we never touch
Cardholder data
No PANs, no CVVs, no expiry dates. The crawler never submits forms or touches payment fields.
Your customers’ PII
No names, addresses, or emails of your shoppers ever reach our systems.
Form input of any kind
ScriptProofBot only reads pages the way a browser loads them — it never types or clicks.
Cookies or sessions of your shoppers
We monitor from the outside. Nothing runs inside your customers’ browsing sessions.
Application security
Controls built into the product
Every claim below describes a control that exists in our codebase today — not an aspiration.
Verified-email-only accounts
Every signup email is vetted before an account row exists: disposable-domain blocklist, provider-typo detection, and a live DNS/MX check on company domains — then a verification link proves mailbox ownership.
Strong password policy
Minimum 10 characters, and passwords that appear on common cracking wordlists are rejected outright at signup, before they are ever hashed.
Database-backed rate limiting
Login, signup and password-reset endpoints have tight per-endpoint limits stored in the database — they survive restarts and are shared across instances.
Hardened session cookies
Sessions are managed by Better Auth with secure, server-issued cookies. No tokens in local storage, no roll-your-own session logic.
Strict security headers
Every response ships HSTS, X-Frame-Options DENY, X-Content-Type-Options nosniff, a strict Referrer-Policy and a locked-down Permissions-Policy.
SSRF-guarded crawling
Every outbound fetch to a customer URL resolves DNS first and refuses private or internal IPs — and every redirect hop is re-validated before it is followed.
Domain verification before monitoring
We never scan a site until you prove you control it with a DNS record or meta tag. Nobody can point ScriptProof at a domain they do not own.
TLS for all traffic
All traffic to and from ScriptProof is encrypted in transit, and HSTS with a two-year max-age instructs browsers to never downgrade.
Infrastructure & operations
Where your data lives
We would rather tell you exactly how it works than hide behind a badge wall.
Single-tenant VPS deployment
ScriptProof runs on dedicated single-tenant infrastructure — your monitoring data does not sit in a shared multi-tenant application pool.
PostgreSQL with role-based access
All data lives in PostgreSQL with role-based database access. Backups are taken at the database layer.
Secrets outside the repository
Credentials and signing secrets are kept in environment files outside the codebase — never committed, never bundled into the client.
SOC 2: on the roadmap, not claimed
We are not SOC 2 certified today and will not pretend otherwise. A formal audit is on our roadmap; until then, this page describes exactly what we do.
Transparent crawling
Our crawler never hides. It identifies itself with the honest user agent ScriptProofBot/1.0 pointing back to a public page that documents exactly what it does, how often it fetches, and how to report unexpected traffic. It only visits domains whose ownership has been verified, never submits forms, and never interacts with payment fields.
Responsible disclosure
Found a vulnerability? Tell us.
If you believe you have found a security issue in ScriptProof, email security@ our domain with the details and steps to reproduce. We commit to acknowledging every good-faith report within 72 hours and to keeping you informed while we investigate and fix. We do not currently run a paid bug bounty program, and we ask that you do not access data that is not yours or degrade the service while testing.
PCI DSS v4.0.1
Supports req. 6.4.3 controls
Req. 11.6.1
Tamper & change detection
SHA-256
Every script fingerprinted
TLS encrypted
All monitoring traffic
Zero card data
Never requested or stored
Server-side
No load on your checkout
ScriptProof is a monitoring and evidence tool. It is not a Qualified Security Assessor (QSA) service and does not certify PCI DSS compliance. Consult your acquirer or a QSA for validation requirements.