Security at Scam Checker

Last updated: 2026-07-17.

Scam Checker is built privacy-first. This page summarises the protections we apply, what we deliberately do not do, and how to report a vulnerability.

1. Privacy-first design

• Scam-check analysis runs in your browser. The full text you paste and file bytes you select are not uploaded. Applicable extracted indicators — a URL, domain, public IP, email, or phone — may be sent securely for community and external reputation checks. Public-IP and domain reputation results can be cached for up to 24 hours and seven days respectively.
• A community-report submission is a separate write: it stores scrubbed private evidence, the normalised target, optional scrubbed notes, country, and keyed request-IP/User-Agent HMACs. Raw request metadata is never stored.
• Public reads expose only eligible report groups after three target-scoped reporters or operator verification. Identifiers use the group's stored masked value; message-like reports use a fixed non-content label. Private evidence and notes are not returned. See the privacy policy for the full list.

2. Defence-in-depth redaction

The /api/report handler scrubs notes and message-like evidence before the row reaches the database. Target identifiers such as an email or URL are retained privately so matching works, while the public path (/reports) reads only confirmed or verified groups and returns their precomputed masked value or a fixed non-content label. The scrubber recognises card and CVV shapes, OTP / 2FA codes, password phrases, US SSN shapes, Australian TFN / Medicare shapes, and JWT-like tokens. It is a safety net, not a reason to submit private information.

3. Security headers

Every page served from scamchecker.app sends:

• Strict-Transport-Security — HSTS with 2-year max-age and includeSubDomains.
• Content-Security-Policy — explicit allowlist for script and style sources. Inline scripts are limited to the JSON-LD and analytics-init blocks.
• X-Content-Type-Options: nosniff.
• X-Frame-Options: DENY + CSP frame-ancestors 'none'so we can't be embedded in clickjacking frames.
• Referrer-Policy: strict-origin-when-cross-origin.
• Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=() — we don't use any of these.

4. API hardening

• Input length limits: value ≤ 500 chars, notes ≤ 1000 chars, allowed type enum enforced server-side.
• Rate limit: 10 report submissions per hour per keyed request-IP HMAC. Beyond that the API returns 429.
• Honeypot field on the submission form — bots that fill hidden fields get a fake success and no database write.
• All errors logged as the error class only — the request body is never written to platform logs.
• URL-intelligence requests permit only public global-unicast HTTP(S) destinations. Every DNS answer and redirect hop is validated, the selected address is pinned to the connection, and redirects, response bytes, and time are bounded.
• Browser mutations require same-origin JSON. Native mobile compatibility headers use strict formats and a fresh timestamp, but are not a verified signature or authenticated identity.

5. Data boundaries

• No advertising cookies, no retargeting pixels.
• No password database. Contact enquiries and confirmed weekly-alert addresses are stored only for their stated purposes and are covered by the deletion process.
• Weekly scam alerts use double opt-in. Resend processes the confirmation email and stores only confirmed subscriber addresses and subscription state; addresses are never linked to checker input or sold for advertising.
• No internal AI prompt is exposed in client HTML — scripts/check-seo-hygiene.mjs enforces this as part of CI.

6. Responsible disclosure

If you've found a security issue, please report it via the responsible disclosure page. We accept good-faith research that does not access other users' data, does not damage service, and does not run destructive payloads.

7. Limitation

Scam Checker is a free privacy-first tool. We can't guarantee zero risk on a complex web platform — but we practise defence-in-depth, minimise data, and disclose what we collect openly. This page is engineering practice, not a legal warranty. See the disclaimer and terms.