Security

Last updated: November 2026

Cuttlefish QA tests and monitors other people's websites, so we take the security of the service and of your data seriously.

Reporting a vulnerability

Email [email protected] with “Security” in the subject line. Please include what you found and where, the steps to reproduce it, and what you think the impact is.

Please give us a reasonable chance to fix a problem before you share it publicly, and don't access, change or delete data that isn't yours. We read every report and will reply to let you know what we decided. We don't run a paid bug bounty program.

The same details are available in machine-readable form at /.well-known/security.txt.

In scope

• The Cuttlefish QA web application at cuttlefishqa.com, including its pages, forms and account features.
• The scanner and browser-check features, including anything that could let a scan reach private or internal addresses, or read data it shouldn't.

Out of scope

• Testing against websites that belong to other customers or third parties.
• Denial-of-service or volume-based testing.
• Social engineering, phishing or physical attacks.
• Reports that only point out missing best-practice headers or settings, with no demonstrated impact.

How we protect your data

• Connections to our site use HTTPS.
• Passwords are stored as one-way hashes, and the site logins and webhook secrets you give us are stored encrypted.
• Scans are limited to public websites, and we block attempts to point them at internal or private addresses.
• Checks that send heavier traffic to a site, such as full crawls and browser checks, require you to verify that you own it first.

More on how we handle information is in our Privacy Policy.