WebDarpan Security & Data Protection
Engineered with strict tenant isolation, encrypted integration storage, SSRF protection, and server-authoritative session security.
1. Multi-Tenant Workspace Isolation
Every account database record, project, audit report, and integration credential is strictly scoped to an organization and workspace ID. Queries enforce database-level workspace boundaries to prevent cross-tenant access.
2. Server-Side Request Forgery (SSRF) Filters
Web crawlers and HTTP verification engines utilize strict SSRF protection filters to block requests to private IP ranges, loopback interfaces (127.0.0.1, ::1), link-local addresses, and unauthorized internal network endpoints.
3. AES-256-GCM Credential Encryption
Third-party access tokens and refresh keys (such as Google Search Console OAuth tokens, GitHub OAuth keys, and CMS API credentials) are encrypted at rest using server-side AES-256-GCM authenticated encryption.
4. Server-Authoritative Session Security
User sessions are managed via cryptographically random tokens stored in HttpOnly, Secure, SameSite session cookies. Client local storage is restricted to non-sensitive UI state hints.
5. Cloudflare Turnstile Bot Defense
Authentication routes (/login, /signup) require Cloudflare Turnstile CAPTCHA verification, which is validated server-side prior to executing any user database lookup or password verification.
6. Account Enumeration Protection
Password reset requests return standardized generic confirmation responses regardless of whether an email address exists in the user database, preventing automated account enumeration.
Action Engine Governance & Fix Verification Safety
When WebDarpan generates platform fixes or connects to CMS platforms (Shopify, Wix, WordPress, Webflow, GitHub), code modifications require explicit user authorization. Automated actions generate pull requests or preview drafts, ensuring human oversight prior to production release.
Health score updates occur only after post-write rescan verification confirms that the fix is actively deployed in the target DOM or JSON-LD schema.
Responsible Disclosure & Security Reporting
If you discover a security vulnerability or concern, please report it directly to our security engineering team.