Trust and Security

Public tools

Vulnerability Management

• No accounts. Nothing here asks you to register, and there is no login to compromise.
• An uploaded scan is parsed and the file discarded. What survives lives in the server's memory, and the container's filesystem is read-only, so it is never written to a disk or a database.
• Two different clocks, both thirty minutes. An analysis session is released thirty minutes after you last touch it — reading it resets the clock. A DNS scan job is removed thirty minutes after it was created, whether or not you are still reading the results. Neither lasts longer than thirty minutes; only one of them waits for you.
• The link is the key. A result link is the only thing protecting that result, and anyone holding it can read it until it expires.
• No model provider. The image serving this site has no AI SDK installed, so no page or route it serves can reach one.

Privacy and data handling VM site

Commercial service

Corporate Due Diligence

• A separate deployment. Due Diligence does not run on this site or in its container. It holds its own configuration and its own credentials.
• Data reaches Anthropic. The research and analysis passes send subject information to Anthropic's Claude models. If you name a person in a request — their role, your stated concerns, your free-text notes — that text is part of what is transmitted.
• Reports are produced without human review. Every report says so in its own words. Nobody reads a report before it reaches you.
• Sources are named and dated in the report itself, including which models and which prompt version produced it.

Due Diligence →

Vulnerability Management

No AI model is used, and this is a fact about installation rather than about intent: neither the Anthropic nor the OpenAI SDK is in the requirements this site's image is built from, so an AI call added to the code would fail rather than work quietly.

Scores come from published evidence — exploitation status, probability, severity and remediation deadlines — combined by a rule that is written down.

How the scoring works →

Corporate Due Diligence

Research and analysis are assisted by Anthropic's Claude models. Registry, sanctions and filing lookups are ordinary API calls to the sources themselves and involve no model at all.

No human reviews a report before delivery. Every report states this on its face rather than leaving it to be discovered. A cited fact is a fact a machine retrieved, and the citation is there so you can check it.

Security

Reporting a vulnerability

There is a published disclosure policy and a machine-readable security.txt. Reports go to [email protected], which is the same address as everything else here — one address that is read, rather than several that are not.

The policy promises neither a bounty nor a fixed remediation deadline, because neither exists.

Security policy VM site

Sources

Where the data comes from

Every outside source the vulnerability tools read is named, with how often each is refreshed, and each third-party dataset is listed with its license and attribution.

Three of them are marked as still under review rather than settled, and the notices page says which. A source whose terms we have not finished establishing is listed as exactly that, not quietly counted among the ones we have.

Listed in one place rather than summarized here, so the list cannot drift from the code that reads it.

Sources and refresh intervals VM site
Third-party notices VM site

Nothing to sign in to

• No session cookie, because there is no session. Our application sets no cookie on any page — not as a policy, but because there is no account mechanism for one to belong to. The content delivery network in front of it may set its own operational cookies, which is outside this application and is why the sentence is scoped to it.
• Two preference cookies, and only when you click. Choosing light or dark writes evulnable_theme or evulnable_pv_theme in your own browser, for one year, and nothing else. They carry a color and no identifier, they are set by the page rather than by the server, and they are named on the privacy page rather than summarized here.
• Nothing you upload is written to disk. A scan is parsed in memory on a container whose filesystem is read-only.
• Every page that can carry your own results is marked not to be cached — Cache-Control: no-store, so a shared or proxied browser does not keep them after you leave. That is a rule applied to a list of paths rather than a decision made page by page, so it covers the analyzer, the DNS checker and their older addresses without anyone having to remember.

What the browser is told

• A Content Security Policy with no escape hatches. default-src 'self', and neither unsafe-inline nor unsafe-eval appears anywhere in it. Scripts and styles load from this site only, with one named exception for Cloudflare's privacy-preserving page analytics.
• The page cannot be framed. frame-ancestors 'none', so it cannot be embedded and clickjacked.
• No content-type guessing, and referrers stay here. X-Content-Type-Options: nosniff, Referrer-Policy: same-origin, and a cross-origin opener policy that isolates the page from anything that opens it.
• Twenty-two browser features are switched off by policy — camera, microphone, geolocation, payment and the rest — because this site needs none of them.
• No API documentation and no source maps are served. The usual documentation endpoints return 404 rather than describing the application to somebody probing it.