What we actually do to keep this secure

Most tools never leave your browser

13 of our 15 tools process everything — files, text, numbers — inside your own browser tab, using its own Canvas and text parsers. There is no upload step and no server that ever sees your input, so there is nothing on our side that could leak it. The full breakdown of which tools touch the network and which do not is on the privacy page.

The two tools that call a server

AI Visibility Checker and Website Speed Test take a URL and fetch it on your behalf, which is exactly the kind of feature that can be tricked into fetching an internal address instead — a server-side-request-forgery (SSRF) attack. Both reject a target before doing anything with it: only http/https, no embedded credentials (user:password@host), and no hostname that only makes sense inside a private network — localhost, anything ending in .localhost, .local, .internal or .home.arpa, and any literal IP address in the loopback, private-use (RFC 1918), link-local or carrier-NAT ranges, including the IPv6 and IPv4-mapped equivalents.

A hostname passing that check can still resolve to a private address, so we also resolve the DNS name and reject the request if any address it returns is private — closing the gap where an attacker points a public-looking domain at 127.0.0.1 or a cloud metadata endpoint. For the AI Visibility Checker, which fetches robots.txt, llms.txt and the homepage directly from our own server, that check runs again on every redirect hop, requests time out after 10 seconds, redirects stop after 3 hops, and the response body is capped at 2 MB so a huge or hanging response cannot tie up the server. The Website Speed Test hands the actual page fetch to Google's PageSpeed Insights infrastructure rather than fetching it from our own server, but the same URL validation and DNS check run first regardless. Both endpoints are also rate-limited per connection, so a script cannot hammer either one indefinitely.

Response headers, set on every page

These are set site-wide in next.config.ts, not just on the tool pages:

• X-Content-Type-Options: nosniff — stops the browser from guessing a file's type and running it as something other than what we declared.
• X-Frame-Options: DENY — this site can never be loaded inside an iframe on another page, which rules out clickjacking.
• Referrer-Policy: strict-origin-when-cross-origin — sends the full URL as a referrer only to our own origin; other sites get just the origin, and nothing at all over a downgrade to plain HTTP.
• Permissions-Policy: camera=(), microphone=(), geolocation=() — this site has no legitimate use for the camera, microphone or your location, so all three are switched off at the browser level.

No accounts, so nothing to leak

There is no signup on this site. We hold no passwords, no user profiles and no payment details, because none of that is ever collected in the first place — the usual account-database breach has nothing to steal here.

Report a vulnerability

If you find a real security issue — an SSRF bypass, a header that is not doing what it claims, anything else — email connect@scult.in with what you found and how to reproduce it. We would ask for reasonable time to fix it before any public disclosure. To be upfront: there is no bug bounty program, so we cannot offer a payout — just a real read and a real fix.