Reporting a security problem
If you find a vulnerability in crawlcheck.io, its API, the browser extension or the published open-source code, email hello@crawlcheck.io with the subject line Security report. The machine-readable version of this page is security.txt.
Report form
Or send it here: it goes straight into the security queue and you get a reference number. Plain text only; describe attachments or link to them.
Lookalike sites
CrawlCheck is only crawlcheck.io. We are not affiliated with any other site, app or account using the CrawlCheck name. To report a site, email or charge that claims to be us, write to hello@crawlcheck.io.
What to include
The URL or endpoint, the steps to reproduce it, what an attacker gains, and whether you believe any data belonging to someone else was exposed. A proof of concept that stops at the first sign of access is enough.
In scope
crawlcheck.io and its subpaths, the public API under /api, report and share links, the lead form script /f.js, the browser extension, and the crawlcheck-core repository.
Please do not
Access, change or delete data that is not yours; run denial-of-service or high-volume automated tests; submit forged leads through another business’s form; use social engineering or physical attacks; or test third-party services we use (Cloudflare, Stripe, Google).
What we will do
Acknowledge your report within three business days, tell you whether we can reproduce it, and keep you informed until it is fixed. We will not pursue legal action against good-faith research that follows this page. With your permission we will credit you when the fix ships.
When free scans are abused
Free scans run in steps: each site is fetched at most once every two minutes, there is a daily total, and when that total is being spent fast a free scan asks for a short proof of work before it runs (HTTP 428, code pow_required). A browser solves it by itself in about a second; an agent can solve it from the rule in the response. Nothing about the visitor is stored and no third-party challenge is loaded. The last step pauses free scans entirely. Scans with a licence key are never part of this.
When something goes wrong
Every incident gets a severity, and the severity sets how fast it is answered and who is told.
| Severity | What it means | Answered | Contained | Who is told |
|---|---|---|---|---|
| 1 · Critical | Trust is broken or data is out: a signing key compromised, private reports or licence keys exposed, wrong signed answers served at scale | within 1 hour | within 4 hours | affected licence holders by email within 72 hours of confirming, and a public notice |
| 2 · High | A protection failed or the service is degraded for others: an outside observer compromised, abuse slowing scans, a seal, backup or restore test failing | within 4 hours | within 24 hours | affected licence holders by email if their answers or reports were affected |
| 3 · Medium | One feature wrong or down, no data exposed | within 1 business day | next release | the changelog |
| 4 · Low | Wording, layout, a dead link | — | routine release | — |
A critical incident is closed only when its cause is fixed and a check exists that would catch it again.
How this site is run
HTTPS only with HSTS, a restrictive content security policy, and fetch requests that refuse private, loopback and link-local destinations. A licence key is a credential: never paste one into a public issue, screenshot or support thread. The full picture — retention, email security, outside services — is in the trust center.