ScamLens

Security — ScamLens

ScamLens takes security seriously. How we handle data, incidents, and responsible disclosure.

Reporting a vulnerability

Email [email protected] with a description, steps to reproduce, and impact. We acknowledge within 48 hours and aim to remediate critical issues within 7 days.

See our vulnerability disclosure policy for scope, safe-harbor terms, and recognition.

Machine-readable summary: /.well-known/security.txt

How we protect data

  • TLS 1.2+ enforced everywhere (HSTS preload, 1-year).
  • Cloudflare Zero Trust + D1 isolation per namespace.
  • API keys encrypted at rest (AES-256-GCM) and scoped per project.
  • No user-submitted content is shared with third parties outside the documented threat-intelligence aggregations.
  • Least-privilege IAM on all cloud integrations; secret rotation every 90 days.

Incident response

Active incidents and historical post-mortems will be published at status.scamlens.org (rolling out). Critical incidents are disclosed to affected users within 72 hours, consistent with GDPR Article 33.

Compliance

  • GDPR / UK GDPR: Lawful basis documented; Data Processing Agreement available on request.
  • CCPA / CPRA: Do-Not-Sell honored; DSAR turnaround within 45 days.
  • SOC 2 Type II: Audit scheduled for 2026 Q3.
  • PCI: payments processed by Stripe; ScamLens does not store card data.

Acknowledgments

Our hall-of-fame for researchers who have helped harden ScamLens will be listed here as we acknowledge valid reports.