Security

ProbeKit runs real network probes for anyone on the internet, so security has two sides: protecting your account and data, and making sure ProbeKit can’t be turned against other people’s systems or our own. This page sets out the commitments we keep.

Report a vulnerability

Email pk@azul-services.com (or use the contact form) with the steps to reproduce and the impact you expect. We reply within a few business days and keep you posted until it is fixed. If you act in good faith (no access to other people’s data, no degrading the service, no public disclosure before we’ve had a reasonable time to fix it) we won’t take legal action against you. Our disclosure contact is also published in security.txt.

Keeping the probes pointed outward

• Every address a tool is about to contact is checked first. Private, internal and reserved address ranges, and our own infrastructure, are refused.
• The checks hold across redirects and changing DNS answers, and apply to background monitors as well as to lookups.

Abuse controls and rate limiting

• Rate limiting on every endpoint, with stricter limits on sign-in and on resource-intensive tools.
• Usage budgets per client and limits on repeatedly probing the same target.
• Monitoring and alerts for abuse, and the ability to switch off any tool within seconds.

Accounts and sign-in

• Passwords are stored only as strong one-way hashes, never in readable form. Repeated failed sign-ins are slowed down and locked out.
• Passkeys are supported (Face ID, Touch ID, Windows Hello or a security key); we store only the public key.
• Sessions and API keys are stored only in hashed form. Session cookies can’t be read by scripts, and every change you make is protected against cross-site request forgery. You can see and revoke your sessions under Account → Security.
• Password reset links are single use and short-lived, and using one signs out every session.
• Microsoft and Google sign-in follow current OpenID Connect practice, and an email address from them is linked to an account only when the provider has verified it.
• Sign-up is protected against automated sign-ups and disposable addresses, and sign-up, sign-in and password reset don’t reveal whether an account exists.

Encryption in transit

• ProbeKit is served only over HTTPS (TLS), and browsers are told never to use plain HTTP.
• Connections to the outside services we use (payments, AI and sign-in providers) are encrypted with TLS and verify the provider’s certificate.
• Every page is sent with security headers, including a Content Security Policy and protection against framing.

Hosting and access

• ProbeKit is hosted on our infrastructure in the United States.
• Access is least-privilege: people and services get only the access they need, the database is not reachable from the internet, and secrets are kept out of the code.
• Logs never contain passwords, form contents or email bodies.
• Inbound report mail is handled defensively: oversized, malformed or unsafe mail is refused.
• Dependencies are checked for known vulnerabilities before every release.

Backups

We keep encrypted off-site backups and test restores.

Your data

What we store and for how long is in the Privacy Policy; business customers can request our full Data Processing Addendum.