Trust
Security
How to report a vulnerability, and how scanning behaves.
Version 1.0
Last updated 2 August 2026
Reporting a vulnerability
If you believe you have found a security issue in RegInspector, email security@reginspector.com. Include enough detail to reproduce the issue. We will acknowledge within [3 working days] and keep you updated until it is resolved.
Please give us a reasonable opportunity to fix the issue before disclosing it publicly. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service degradation, and do not access or modify data beyond what is needed to demonstrate the issue.
How scanning works
- A scan issues ordinary GET requests to publicly available pages, identifying itself as RegInspectorBot.
- It does not test for vulnerabilities, attempt authentication, submit forms or execute attacks.
- Requests resolving to private, loopback or link-local addresses are refused, so the scanner cannot be pointed at internal infrastructure.
- Response bodies are capped and redirects are bounded.
Our own posture
- All traffic is served over TLS, with HSTS enforced.
- Report links use unguessable identifiers; a report is only reachable by someone holding its link.
- Card data never reaches our servers — Stripe Checkout handles payment end to end.
- Webhook payloads are verified against the Stripe signature before any report is unlocked.
- Free scan data is deleted automatically after 30 days.
security.txt
Machine-readable contact details are published at /.well-known/security.txt.