Target isolation
Private networks, loopback, link-local addresses and cloud metadata endpoints are blocked. Redirects are independently checked.
SECURITY
Designed to fail closed.
Shopsteddy treats target URLs, browser sessions and platform credentials as security boundaries. If the service cannot establish a safe target or valid authorisation, it does not continue by quietly weakening those checks.
SCANNER SECURITY
Boundaries are enforced before requests are made.
Credential isolation
Web Bot Auth, Shopify crawler credentials and Shopify Admin API tokens are separate secret classes and are never forwarded to unrelated origins.
Browser isolation
Customer scans use fresh browser contexts with no shared cookies, local storage or persistent profiles between tenants.
Protection-aware behaviour
403, 429, Cloudflare challenges and Shopify security rejections reduce or stop traffic rather than triggering evasion.
PROHIBITED MECHANISMS
We do not evade site controls.
Shopsteddy production scanning must not use residential proxy rotation, browser-stealth plugins intended to evade detection, fingerprint spoofing, CAPTCHA solving, fake search-engine identities or arbitrary customer-supplied authentication headers.
REPORT A VULNERABILITY
Send us a concise reproduction path and impact.
Email security@qaxx.io. Do not include production secrets in the first message. Our machine-readable disclosure contact is published at /.well-known/security.txt.