Security

What we actually do — and what we don't claim.

What we do

• URL validation on every input; no SSRF-friendly free-for-alls.
• Safe Browsing API key and SMTP credentials via environment variables only. Hosted-API keys (ms_live_) are stored only as SHA-256 hashes; a purchased key is revealed exactly once via the claim page. Without a Safe Browsing key, blacklist status is reported as 'not configured' — never as clean or infected.
• Scan traffic is read-only GETs against your own sites — we never log in to anything.
• We are not SOC 2 certified. Incident data lives in a database you control.

What we don't claim

We are not SOC 2 certified, not ISO 27001 certified, and we don't use the phrase "military-grade encryption". If we name a cipher, we name the key management next to it. Security claims on this page describe the software as shipped — verified in the product repo, not in a badge.

Report an issue

Found a vulnerability? Email don+malshield@lifeofmorr.com with details. We respond to good-faith reports promptly and don't pursue researchers who follow responsible disclosure.