Designed around untrusted URLs and sensitive business context.

StackCost Radar handles vendor spend context and fetches user-supplied public URLs. The MVP applies defense in depth appropriate to those risks.

Collector protections

• HTTP and HTTPS only, with credentials and nonstandard ports rejected.
• DNS resolution is validated and pinned before connection; private, loopback, link-local, and reserved addresses are blocked.
• Every redirect is revalidated to prevent redirect-to-private-network attacks.
• Strict response time, size, content-type, and redirect limits.
• No login bypass, CAPTCHA evasion, or access-control circumvention.

Application and data protections

• Password hashing and secure session cookies are provided by Better Auth.
• Workspace authorization is enforced server-side for every private resource.
• Mutation requests enforce same-origin checks and high-risk public endpoints are rate-limited.
• Slack webhooks are encrypted with AES-256-GCM before storage.
• Stripe webhook signatures are verified before subscription state changes.
• Raw HTML is not retained; the product stores normalized page text, hashes, extracted facts, and relevant diffs.

Responsible disclosure

Until a dedicated security inbox is configured, report vulnerabilities to the support address published for your deployment. Do not access other customers’ data or degrade service while testing.

This page describes the shipped controls and is not a certification or guarantee. SOC 2, SSO/SCIM, formal penetration testing, and enterprise audit controls are not part of the MVP.