Security and responsible disclosure

Last updated: 17 October 2026.

SourceKeel is operated by Scydex Ltd. Report a suspected vulnerability to [email protected] with the subject "SourceKeel security report". Our machine-readable contact is at security.txt.

How we protect your account

SourceKeel has no passwords. You sign in with an 8-digit code we email to you, or with Google or AgentID. A code works once, expires after 15 minutes, and stops working after 5 wrong tries. We limit how many codes can be requested for each email address and each network.

Every sign-in starts a new session. A browser session ends after 7 days without use, or 30 days after you signed in. An agent's API session ends after 1 hour. In the console, Account settings shows where you are signed in. You can end any session there, or sign out everywhere.

We email you when your account is signed in to from a device it hasn't used in 90 days. We also email you when someone signs out everywhere, when an agent joins your account or makes a key, and when a new sign-in method is linked. You can't turn these emails off.

Some actions need a fresh code from your email, even when you are already signed in: a checkout, a billing portal visit, an overage change, a change to a key's cap, expiry, or permissions, an agent approval, and an account export or deletion. The confirmation lasts 10 minutes, and only a browser session can get one. An agent's API session cannot.

Keys and session tokens are long random values. We store them only as hashes, so we cannot read them back. You can give a key a monthly credit cap and an expiry date. An account can have up to 10 agents, each with up to 10 keys. An agent cannot raise its own cap or turn on overage. It can ask, and a person on the account decides.

How we protect the service

  • Every page and API answer is served over HTTPS, and browsers are told to use HTTPS for future visits.
  • Every form that relies on your sign-in cookie, including the sign-in and sign-up forms, carries a signed token. Another website cannot send those forms for you.
  • Pages carry security headers: a content security policy with a fresh value on each page, a block on being framed by other sites, and a block on content-type guessing.
  • Requests are rate limited for each route, each account, and each plan.
  • Before any route runs, an input guard refuses characters that have no place in a request, such as null bytes and control characters in a path. Request bodies have size limits.
  • A test checks that every route refuses a caller with no credentials, except the public pages.
  • We log security events, such as wrong codes and refused keys, without the codes, keys, or email addresses involved.
  • Stripe handles card details. We check the signature on every message Stripe sends us.
  • Staff sign in with an email address, an access key, and a code from an authenticator app, and only from approved networks. Every staff page view and change is recorded. Staff pages never show keys, tokens, or sign-in codes, and staff cannot act as a customer.

Our OWASP work

We are checking SourceKeel against the OWASP Top 10 and the OWASP Application Security Verification Standard (ASVS 4.0.3) at Level 2. Each Level 2 requirement is mapped to the code that meets it and the test that shows it. The work is not finished. Some requirements are met only in part, and some depend on hosting changes that are still to come. We do not claim ASVS Level 2 compliance.

What to include

  • The affected SourceKeel hostname and route.
  • A description of the issue and its impact.
  • Minimal steps to reproduce it using your own account.
  • The relevant time and request ID, if available.
  • A safe reply address.

Remove passwords, API keys, payment tokens, and other people's personal data. If sensitive evidence is necessary, ask for a secure transfer method first.

Testing boundaries

This page covers sourcekeel.com, api.sourcekeel.com, and mcp.sourcekeel.com. Test only systems and accounts you own or have permission to use. Use the smallest test needed to demonstrate the issue. Stop if you encounter another person's data. Do not copy it or investigate further. Do not disrupt service, bypass payment to consume capacity, or use social engineering. Do not test Stripe, hosting providers, inbox providers, or other third-party systems under this policy. Contact us before testing that can affect availability or other customers.

Coordinated disclosure

Give us a chance to investigate and fix the issue before you publish exploitable details. We aim to acknowledge a report within 5 working days and to keep you informed as we work on it. We agree a disclosure date with you, normally within 90 days of your report. If you act in good faith and follow this page, we will not take legal action against you for your research. We do not run a paid bug bounty. This page does not authorize testing beyond the boundaries above or waive another party's rights.

Account incidents

If a key is exposed, revoke it in the console. If you think someone else is signed in to your account, end that session in Account settings, or sign out everywhere. Then contact [email protected]. If an inbox is compromised, secure the inbox and tell us about the affected SourceKeel account. Use the support page for ordinary data, billing, and API questions.

Sign-in, account and form security, and your saved cookie choice.

Google Fonts and the interactive reference from unpkg. These providers receive browser request information.

Read the cookie inventory.