Security — Plumbline

What Plumbline holds

The addresses of the sites you asked us to watch.
Screenshots of those pages, as a visitor would see them.
Your team’s accounts — email address and a password hash.
Where your alerts go: email addresses, and a Slack webhook if you use one.
The result of every check, with the request and response that produced it.

What it deliberately does not hold

This list is shorter to defend than it is to write, which is the point of it.

No card details. Ever. When payment is added it will be handled by a processor and card numbers will not reach our servers. That is also why PCI DSS does not apply to us.
No access to your clients’ systems. No FTP, no SSH, no database, no WordPress admin, no plugin. We watch from outside, so there is nothing for an attacker to take from us that would let them into a client site.
No records belonging to your clients’ customers. We see public pages, not what is behind a login.

Keeping agencies apart

Every query that touches an agency’s data is scoped to that agency at the layer below the code that asks, rather than by each handler remembering to filter. Tests assert that a request for another agency’s data is refused. One agency reading another’s client list is the failure that would end this product, so it is prevented structurally and not by discipline.

Not letting ourselves be used as a weapon

A tool that fetches any address you type is a tool that can be pointed at someone else. Two things stop that.

Ownership is verified before the first check. A DNS record, a file, or a meta tag — see how it works. Verification is re-checked, and a site that stops verifying is paused.

Addresses are validated before they are fetched. Only http and https. The hostname is resolved and the resolved address is rejected if it is private, loopback, link-local, or a cloud metadata endpoint — and every redirect is re-validated before it is followed, because a redirect is just another address supplied by someone else.

Secrets

A Slack webhook is a credential: anyone holding it can post into your Slack. It is never shown back through the interface or the API, never written to a log, and is encrypted at rest with AES-GCM.

We are precise about what that encryption does, because encryption is the most over-claimed word in this industry. The key lives on the same machines the application does, so it does not defend against an intruder who has taken the application — nothing here pretends otherwise. What it closes is every route by which data escapes without the application: a backup, a snapshot, a read replica, a database dump pulled onto a laptop to chase a bug, a decommissioned disk. Those carry rows and not the environment.

Keys can be rotated without downtime, which is what makes “rotate on any suspicion” something that actually happens rather than something that is always postponed until the week it is needed.

Accounts

Passwords hashed with Argon2id.
Email verification required before an account is useful.
Session cookies are HttpOnly, Secure and SameSite.
Sign-up is invitation-only on the public deployment. An account is the thing that can ask us to fetch a website, so a stranger should not be able to create one.
An invitation code is treated as a credential: long, single-use, expiring after thirty days, and optionally bound to one address so a forwarded code is useless.

What is still open

A security page with no open items is a security page nobody checked. These are ours, as of 19 September 2026.

Network isolation is not complete: The address validation above is real and it is not sufficient on its own. Two gaps remain, and both are closed by infrastructure rather than by code: a browser rendering a page fetches whatever that page references, and only the first address was validated; and a hostname can answer differently between the moment we approve it and the moment the connection is made. Until the workers run somewhere with no route to private space, that validation is a speed bump and we describe it as one.
Two-factor authentication is not shipped: It is designed and intended to be mandatory for account owners. It is not built yet. Until it is, your password and your email account are what stand between someone else and your Plumbline account.
We hold no compliance certification: No SOC 2, no ISO 27001. Neither is legally required for what we do, and buying one at this stage would be buying a logo rather than a control. If you need one to sign, tell us — knowing that would change the plan.
Encryption keys are held in the environment: Not in a managed key service. That is a reasonable answer for a webhook URL you can re-enter and a poor one for the authenticated- check credentials we intend to support later. The stored format is versioned so that moving to managed keys does not mean re-encrypting everything under pressure.

If you find something

Write to hello@plumbline-lb.com with enough detail to reproduce it. We will confirm we received it, tell you what we found, and tell you when it is fixed. We will not threaten you, and we will credit you if you want to be credited.

If a breach affects data we hold for you, you will hear from us within 72 hours of us becoming aware of it, whether or not we have finished understanding it.

The reasoning behind all of the above, in more depth than a marketing page should carry, is kept in the repository as docs/05-SECURITY.md.

What we hold, what we refuse to hold, and what is still open.