Vulnerability Analysis

What happens to your file

It is parsed on upload and the original bytes are discarded — only the normalized findings are kept, and they are kept in this server process's memory. Nothing is written to a file, a temporary directory or a database, because the container's filesystem is read-only. They are released 30 minutes after you last touch the analysis, when you clear it, or when the service restarts — whichever comes first.

The link is the key. Once your analysis is running, its address looks like /analysis?s=…, and that identifier is the only thing protecting it. There is no account and no password. Anyone who has the link — from your browser history, a copied URL, a screenshot, a shared screen, a bookmark you sync — can open the analysis and download every export from it, including the asset names, hostnames and IP addresses in your upload, for as long as the session lives. The identifier is long and random, so it will not be guessed; it will be read by anyone you hand it to. Treat the URL the way you would treat the file itself, and use Clear uploaded data now when you are finished rather than waiting for it to expire.

Two more things that would be overclaiming if left unsaid: this is server-side memory, not browser-only, because an export has to be generated from the same data you are looking at; and process memory can be paged to swap by the host kernel, so "memory" is not a cryptographic guarantee.

Nothing from the upload is sent anywhere. Asset names, hostnames, IP addresses and the file itself never leave this container. The CVE identifiers in your file are matched against CISA KEV and FIRST EPSS data already downloaded here, so those lookups make no outbound request at all. This site sends no referrer off-site, so the link is never handed to a vendor advisory or NVD page you click through to.