Security

Infrastructure

Aback Inspect runs entirely on Cloudflare: the application and API on Workers, metadata in D1, screenshots and traces in a private R2 bucket, jobs on Queues, and browsers on Cloudflare Browser Run. There are no other servers or databases.

Browser isolation

• Every run starts a new browser session and context. Cookies, local storage and cache are never reused between runs, tests or workspaces.
• Browsers can only reach the hosts listed for the environment and project. Cloudflare Browser Run guardrails enforce this for every request the page makes, including scripts, frames, images and redirects, and the page cannot change it.
• Downloads, service workers and browser permissions are disabled. New tabs are closed.
• Tests are a validated data format. Nobody, including an AI agent, can run arbitrary code through a test.

Protection against server side request forgery

• Targets must use http or https on ports 80 or 443 and a public host name. IP addresses, localhost, private and link-local ranges, cloud metadata addresses and internal names are refused.
• Host names are resolved over DNS before a run is accepted, and every answer must be a public address.
• Server side fetches, such as domain verification and link checks, may only reach public addresses.
• An allowed host could still redirect or proxy to somewhere else, so allow only hosts you trust.

Accounts and access

• Passwords are hashed with PBKDF2-SHA256. Sessions are random tokens stored as hashes, in HttpOnly, Secure, SameSite cookies, and changing a password signs out other devices.
• Requests from the app must come from the app's own origin with a custom header, which blocks cross site request forgery.
• Workspace roles (owner, admin, member, viewer) are enforced on the server for every request. Every query is scoped to the caller's workspace; another workspace's identifiers answer as not found.
• API keys are shown once and stored as SHA-256 hashes, carry read, run and write scopes, can expire, and can be revoked at once.
• Security relevant changes are written to an audit log that owners and admins can read.

Secrets and data

• Project secrets and webhook URLs are encrypted with AES-256-GCM, bound to their record, and decrypted only when used.
• Secret values are masked in step results, logs and error messages. Query strings are removed from stored URLs, and response bodies are never stored.
• Run evidence is deleted automatically after the plan's retention period.
• Payments are handled by Dodo Payments. Card details never reach our systems.

Responsible use

Only test websites you own or have permission to test. Scheduled runs require proof of domain control. We do not bypass CAPTCHAs, paywalls, authentication or bot protection. Accessibility checks are basic automated rules and do not certify WCAG conformance. See the terms.

Reporting a vulnerability

Email support@aback.group with the details. Please give us reasonable time to fix an issue before disclosing it, and do not access data that is not yours.