How our checks work

What it is

Vediqx checks whether an app exposes data it should not — tables a stranger can read, keys left in shipped code, sign-up settings that let anyone in. It runs because the app's owner asked it to, against the address they gave.

If you didn't ask for this check, someone gave us an address that wasn't theirs to give. Tell us at security@vediqx.com.

• The pages at the address the owner gave, and the script files those pages name — the same files any visitor's browser downloads.
• Source maps, where the app publishes them, because a browser can download them too.
• If the app's own code names a Supabase project, that project's public API, as a signed-out stranger would reach it.

It identifies itself on every request: Vediqx/1.0 (+https://vediqx.com/security)

What it changes, and when

• The Outside check only reads. The one exception is in form, not intent: listing Supabase storage is a read that must be sent as a POST. It is the only request other than GET the Outside check sends.
• The Inside check makes test writes and undoes every one. It runs only on a database its owner connected, and only on the terms they agreed to: Vediqx makes a few test writes as each of your test users and undoes every one in the same step, so nothing is kept. A single row is held for under a second, and an id counter may skip a number. Tables too large for this are counted, never written to.

• It never guesses a password or creates an account for itself. When it signs in, it uses an account the owner gave us for that.
• It never follows a redirect while sending a body, and it sends your app's firewall header and key only to your app's own address, so a redirect can't choose who receives them.
• It does not connect to private or loopback addresses. An app that resolves to one is refused rather than checked.

At most, per host, at one time

4 requests

Each request gives up after

10 seconds

It stops reading a file past

2 MB

It follows at most

5 redirects

A check of an address you haven't added reads

up to 10 pages and 12 script files a page

A check of an app you've added reads

up to 40 pages and 40 script files a page

It does not read robots.txt, and does not treat it as permission either way: a check happens because an owner asked for it, not because a file allowed it.

• From a check: the address, and the findings — table and column names, how many rows a stranger could reach, and the first and last few characters and the length of any key we find.
• For your account: your email address, to sign you in and send the alerts you turn on.
• When you connect a database: the findings, who can do what, counts and data types, and the database host and Supabase project reference you entered.
• Passwords and keys you give us, such as a Stripe restricted key, and the password of the database role you create: encrypted, as described below.

• The values in your rows.
• A key we find in your code, whole: only its first and last few characters and its length.
• A working Vediqx API key. We show it to you once, and keep only its SHA-256 digest, which can't be turned back into the key, and its first few characters, so you can tell keys apart.
• A password or key in plain text.
• Analytics or advertising trackers. We do not sell your data.

How we encrypt passwords and keys

We encrypt passwords and keys before we store them. This website can encrypt them but can't decrypt them. Only the separate system that runs your checks holds the key that decrypts them.

Encryption

libsodium crypto_box_seal

Each encryption uses

a new X25519 key and an XSalsa20-Poly1305 box

The website holds

the public key only

Your database role's password

32 random bytes, made for your app alone

The setup code you run holds only a one-way form of that password (its SCRAM verifier), and we never show the password itself. Removing an app deletes its encrypted passwords and keys.

Report a vulnerability

Write to security@vediqx.com with what you found, where, and the steps to reproduce it. Test only against your own account and your own apps, and do not read, change or delete anyone else's data to show a problem.

How to stop it, or reach us

Block the user agent above at your edge. We never retry around a block, and a check that can't reach an app says so; it never reports the app as fine.

Anything about a check you did not ask for: security@vediqx.com. Everything else: support@vediqx.com.

This page is at https://vediqx.com/security, which is the address carried in every request above.