Privacy and data boundaries

What a scan observes

Reports may include public response metadata, parsed discovery signals, status codes, bounded redacted excerpts, timestamps, and scanner findings. The scanner does not request passwords, submit forms, or intentionally collect private page content.

What is not displayed

Public reports do not expose authorization headers, API keys, cookies, session tokens, raw client IP addresses, or unbounded response bodies. Protected cross-site actions use the shared PLATPHORM_API_KEY only on the server.

Retention

Report persistence is best-effort and subject to the configured report store. A public report is a point-in-time observation, not a continuous monitoring guarantee.