Security at LiveAPISec

How we protect the platform

• Encryption in transit and at rest. All traffic uses HTTPS with HSTS; API credentials are encrypted server-side with AES-256 and are never written to logs.
• Isolated scans. Automated tests run from our scanner in an isolated sandbox with polite pacing and hard limits. Targets are contacted only as part of an authorized scan.
• Least privilege and scoped keys. The CLI uses scoped Developer API keys; login keys expire after 30 days. Keys can be revoked at any time from Settings.
• Ownership verification. Advanced and destructive tests require domain verification (DNS TXT, CNAME, HTTP file) and recorded consent.
• Security headers. The public site sends HSTS, a Content-Security-Policy, X-Content-Type-Options, a Referrer-Policy and a restrictive Permissions-Policy. Public trust pages relax frame-ancestors only so customers can embed their certificate widget.
• Deterministic core. Detection is deterministic and reproducible; AI is used for triage and optional agent probes, never as the sole basis for a finding.

Responsible disclosure policy

We welcome reports about the LiveAPISec website, API and CLI. Please:

• Email [email protected] with steps to reproduce and impact.
• Give us reasonable time to fix the issue before public disclosure.
• Do not access, modify or exfiltrate other customers’ data.
• Do not run denial-of-service tests, spam or social engineering.
• Test only accounts and projects you own or are authorized to test.

This policy does not authorize testing third-party APIs or infrastructure. Scans against customer targets must go through the product with recorded consent.

Scope and limitations

LiveAPISec performs automated black-box security tests within the scope of the API specification and configuration you provide. It is not a full manual audit and does not guarantee security. Certificates describe the state at the time of the last scan and are not a certification. See the disclaimer on each trust certificate.