SiteSentinel Security

SiteSentinel applies layered protection for accounts, organization data and monitoring mechanisms. This page describes current security principles and is not a guarantee that all risk is eliminated or a compliance certificate.

Account security

Passwords are stored only as secure cryptographic hashes. Sessions use HttpOnly, Secure and SameSite cookies. State-changing operations are protected by permissions, validation, rate limiting and CSRF where required.

Organization isolation

User data belongs to organizations. Access is verified server-side and roles limit functions and information.

Monitoring security

URLs are normalized and checked. Private and local IPs are blocked. Ports, redirects, response time and downloaded size are limited to reduce SSRF risk.

Transmission and secrets

Communication uses HTTPS. Secrets are not placed in public code or sent to browsers.

Vulnerability reporting

Report suspected vulnerabilities to security@sitesentinel.pl with description, reproduction steps and possible impact. Do not publish details before analysis is complete.

Limitations

SiteSentinel helps detect operational issues but does not replace a security audit, penetration test, infrastructure administrator or legal consultation.