Security practices
How VisibleMax protects customer data: auth, HTTPS, payments, least privilege, and vulnerability reporting.
Updated 2026-08-06
Security is part of making AI visibility trustworthy. VisibleMax protects customer workspaces with managed authentication, encrypted transport, scoped access, and a clear path to report vulnerabilities.
Core controls
| Area | Practice |
|---|---|
| Authentication | Supabase Auth for signup, login, and session management |
| Transport | HTTPS for the application and API surfaces |
| Payments | Polar hosts checkout and billing portal — card data stays with the payment provider |
| Access | Least privilege for service credentials and workspace-scoped product data |
| Isolation | Workspace/project boundaries so one customer’s scans are not exposed to another |
Operational practices
- Secrets and API keys live in environment configuration, not in client bundles.
- Server actions and APIs enforce auth and entitlement checks before starting scans or reading reports.
- Crawl targets are constrained to customer-provided public URLs with safety checks against abusive destinations.
- Rate limits reduce abuse on free tools, quick scan, and workspace scan creation.
Report a vulnerability
If you find a security issue, email [email protected] with reproduction steps, impact, and any proof of concept. Please allow reasonable time to remediate before public disclosure.
- In-scope examples: auth flaws, workspace data isolation bugs, injection, and issues that expose customer data or manipulate scan results.
- Out of scope: social engineering, physical attacks, and third-party services we do not control.
- Program details: Bug bounty.
FAQ
Where do credit cards go?
Checkout and stored payment methods are handled by Polar. VisibleMax does not store raw card numbers.
Who can see my reports?
Members of your workspace (and anyone you intentionally share a public report link with). Support access is limited to investigating issues you raise.
Related
Still stuck? Contact support with your project URL and what you already tried.