Outside-in by design
Guardian begins only after domain-control verification. It observes supported public website, DNS, TLS, HTTP-header, and email-security signals. Basic monitoring does not require registrar, hosting, mailbox, source-code, or private-network credentials. It does not perform penetration testing, exploit vulnerabilities, or run load tests against monitored domains.
Bounded network requests
HTTP checks resolve a monitored hostname to public addresses, reject non-public or mixed answers, cap the number of endpoints, use short timeouts, and do not follow redirects. These controls reduce SSRF and unbounded-request risk; they do not make every network dependency risk-free.
Account protection
Passwords are one-way hashed with Argon2id when available and bcrypt as the fallback. Production sessions use Secure, HttpOnly, SameSite=Lax, host-only cookies, rotate periodically, and expire after idle and absolute limits. Sensitive forms use CSRF tokens and authentication endpoints use account and source rate limits. Google and GitHub sign-in uses state binding and PKCE; provider access tokens are not retained as account credentials.
Data and secret boundary
The application database, WAL files, mail configuration, OAuth secrets, and operational credentials are kept outside the public web root. Public directory listing and direct access to internal source, configuration, database, log, and worker files are denied. Production traffic is expected over HTTPS with HSTS and defensive response headers.
What we do not claim
CyberReflex is not currently certified to ISO/IEC 27001 or audited for SOC 2. The public beta has no enterprise SLA, no guarantee of complete detection, and no guarantee that a monitored domain is secure. Monitoring evidence should support a decision, not replace backups, provider access controls, change management, or qualified incident response.
Report a security concern
Send a clear description, affected URL or account boundary, reproduction steps, and impact to contact@cyberreflex.com. Do not access other users’ data, disrupt the service, perform denial-of-service testing, or include secrets in the report. We will acknowledge a credible report and coordinate a safe validation path.